Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4904-1)

medium Nessus Plugin ID 148498
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4904-1 advisory.

- The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program. (CVE-2015-1350)

- The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the
__timer_stats_timer_set_start_info function in kernel/time/timer.c. (CVE-2017-5967)

- The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16644)

- An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork. (CVE-2018-13095)

- drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16231)

- drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16232)

- A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3. (CVE-2019-19061)

- A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.
(CVE-2021-20261)

- An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

- An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
(CVE-2021-26931)

- An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
(CVE-2021-28038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-4904-1

Plugin Details

Severity: Medium

ID: 148498

File Name: ubuntu_USN-4904-1.nasl

Version: 1.2

Type: local

Agent: unix

Published: 4/14/2021

Updated: 4/14/2021

Dependencies: ssh_get_info.nasl, linux_alt_patch_detect.nasl

Risk Information

CVSS Score Source: CVE-2017-16644

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 5.8

Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:16.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1090-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1091-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1126-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1150-raspi2, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1154-snapdragon, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-208-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-208-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-208-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-utopic, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-vivid, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-wily, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-utopic, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-vivid, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-wily, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial, p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-utopic, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-vivid, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-wily, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial, p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2, p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-lts-utopic, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-lts-vivid, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-lts-wily, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-lts-xenial

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/13/2021

Vulnerability Publication Date: 7/29/2015

Reference Information

CVE: CVE-2015-1350, CVE-2017-5967, CVE-2017-16644, CVE-2018-13095, CVE-2019-16231, CVE-2019-16232, CVE-2019-19061, CVE-2021-20261, CVE-2021-26930, CVE-2021-26931, CVE-2021-28038

USN: 4904-1