Ubuntu 14.04 LTS : Linux kernel (Azure) vulnerabilities (USN-3847-3)
high Nessus Plugin ID 119829
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 6.7
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 LTS.It was discovered that a race condition existed in the raw MIDI driver for the Linux kernel, leading to a double free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10902)
It was discovered that an integer overrun vulnerability existed in the POSIX timers implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2018-12896)
Noam Rathaus discovered that a use-after-free vulnerability existed in the Infiniband implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2018-14734)
It was discovered that the YUREX USB device driver for the Linux kernel did not properly restrict user space reads or writes. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-16276)
It was discovered that the BPF verifier in the Linux kernel did not correctly compute numeric bounds in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-18445)
Kanda Motohiro discovered that writing extended attributes to an XFS file system in the Linux kernel in certain situations could cause an error condition to occur. A local attacker could use this to cause a denial of service. (CVE-2018-18690)
It was discovered that an integer overflow vulnerability existed in the CDROM driver of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-18710).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected linux-image-4.15-azure and / or linux-image-azure packages.See Also
Plugin Details
Severity: High
ID: 119829
File Name: ubuntu_USN-3847-3.nasl
Version: 1.5
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 12/21/2018
Updated: 9/17/2020
Risk Information
Risk Factor: High
VPR Score: 6.7
CVSS v2.0
Base Score: 7.2
Temporal Score: 5.3
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
CVSS v3.0
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-azure, cpe:/o:canonical:ubuntu_linux:14.04
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 12/20/2018
Vulnerability Publication Date: 7/2/2018
Reference Information
CVE: CVE-2018-10902, CVE-2018-12896, CVE-2018-14734, CVE-2018-16276, CVE-2018-18445, CVE-2018-18690, CVE-2018-18710
USN: 3847-3