Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4344-1)
medium Nessus Plugin ID 136087
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 5.2
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash).(CVE-2019-16234)
It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did not properly deallocate memory in certain situations. A local attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19051)
Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768)
It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). (CVE-2020-10942)
It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)
Shijie Luo discovered that the ext4 file system implementation in the Linux kernel did not properly check for a too-large journal size. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (soft lockup).
(CVE-2020-8992)
Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 136087
File Name: ubuntu_USN-4344-1.nasl
Version: 1.3
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 4/29/2020
Updated: 9/17/2020
Risk Information
Risk Factor: Medium
VPR Score: 5.2
CVSS Score Source: CVE-2020-10942
CVSS v2.0
Base Score: 5.4
Temporal Score: 4
Vector: AV:L/AC:M/Au:N/C:N/I:P/A:C
Temporal Vector: E:U/RL:OF/RC:C
CVSS v3.0
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Temporal Vector: E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-gke, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-oem-osp1, p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-5.0, p-cpe:/a:canonical:ubuntu_linux:linux-image-oem-osp1, cpe:/o:canonical:ubuntu_linux:18.04:-:lts
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 4/28/2020
Vulnerability Publication Date: 9/11/2019
Reference Information
CVE: CVE-2019-16234, CVE-2019-19051, CVE-2019-19768, CVE-2020-10942, CVE-2020-8648, CVE-2020-8992, CVE-2020-9383
USN: 4344-1