Detections
Analytics

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4116-1)

high Nessus Plugin ID 128476

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4116-1 advisory.

 - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
 __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

 - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (CVE-2019-10638)

 - In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c. (CVE-2019-13648)

 - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. (CVE-2019-14283)

 - In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default. (CVE-2019-14284)

 - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

https://ubuntu.com/security/notices/USN-4116-1

Plugin Details

Severity: High

ID: 128476

File Name: ubuntu_USN-4116-1.nasl

Version: 1.10

Type: local

Agent: unix

Published: 9/3/2019

Updated: 1/9/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-14283

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2018-20856

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1056-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1092-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1120-raspi2, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1124-snapdragon, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-powerpc-e500mc, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-powerpc-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-powerpc64-emb, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-161-powerpc64-smp, cpe:/o:canonical:ubuntu_linux:16.04:-:lts

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/2/2019

Vulnerability Publication Date: 4/25/2019

Reference Information

CVE: CVE-2018-20856, CVE-2019-10638, CVE-2019-13648, CVE-2019-14283, CVE-2019-14284, CVE-2019-3900

USN: 4116-1