USN-3752-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS.

It was discovered that, when attempting to handle an out-of-memory situation, a NULL pointer dereference could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-1000200)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10323)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-data information consistent in some situations. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations.
An attacker could use this to specially craft an ext4 filesystem that caused a denial of service (system crash) when mounted.
(CVE-2018-1093)

Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive information. (CVE-2018-1108)

It was discovered that the procfs filesystem did not properly handle processes mapping some memory elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem to report operating system state, such as ps(1). (CVE-2018-1120)

Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep xattr information consistent in some situations. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-11412)

Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-11506)

Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer overflow when handling extended attributes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-12233)

Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform permission checks in some situations when nested virtualization is used. An attacker in a guest VM could possibly use this to escape into an outer VM or the host OS.
(CVE-2018-12904)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash).
(CVE-2018-13094)

It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-13406)

Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5814)

It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that, when attempting to handle an out-of-memory situation, a NULL pointer dereference could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-1000200)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10323)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-data information consistent in some situations. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations.
An attacker could use this to specially craft an ext4 filesystem that caused a denial of service (system crash) when mounted.
(CVE-2018-1093)

Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive information. (CVE-2018-1108)

It was discovered that the procfs filesystem did not properly handle processes mapping some memory elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem to report operating system state, such as ps(1). (CVE-2018-1120)

Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep xattr information consistent in some situations. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-11412)

Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-11506)

Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer overflow when handling extended attributes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-12233)

Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform permission checks in some situations when nested virtualization is used. An attacker in a guest VM could possibly use this to escape into an outer VM or the host OS.
(CVE-2018-12904)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash).
(CVE-2018-13094)

It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-13406)

Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5814)

It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added :

  - NVDIMM memory error notification (ACPI 6.2) The     following security bugs were fixed :

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function could have result in local     attackers being able to crash the kernel or potentially     elevate privileges because kmalloc_array is not used     (bnc#1100418)

  - CVE-2018-13053: The alarm_timer_nsleep function had an     integer overflow via a large relative timeout because     ktime_add_safe was not used (bnc#1099924)

  - CVE-2018-9385: Prevent overread of the 'driver_override'     buffer (bsc#1100491)

  - CVE-2018-13405: The inode_init_owner function allowed     local users to create files with an unintended group     ownership allowing attackers to escalate privileges by     making a plain file executable and SGID (bnc#1100416)

  - CVE-2017-5753: Systems with microprocessors utilizing     speculative execution and branch prediction may have     allowed unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bsc#1068032)

  - CVE-2018-1118: Linux kernel vhost did not properly     initialize memory in messages passed between virtual     guests and the host operating system. This could have     allowed local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net     device file (bsc#1092472)

  - CVE-2018-12233: A memory corruption bug in JFS could     have been triggered by calling setxattr twice with two     different extended attribute names on the same file.
    This vulnerability could be triggered by an unprivileged     user with the ability to create files and execute     programs (bsc#1097234)

  - CVE-2018-5848: In the function wmi_set_ie(), the length     validation code did not handle unsigned integer overflow     properly. As a result, a large value of the 'ie_len'     argument could have caused a buffer overflow     (bnc#1097356)

  - CVE-2018-1000204: Prevent infoleak caused by incorrect     handling of the SG_IO ioctl (bsc#1096728)

  - CVE-2018-3639: Systems with microprocessors utilizing     speculative execution and speculative execution of     memory reads the addresses of all prior memory writes     are known may have allowed unauthorized disclosure of     information to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4 (bsc#1087082)

  - CVE-2018-1120: By mmap()ing a FUSE-backed file onto a     process's memory containing command line arguments (or     environment strings), an attacker could have caused     utilities from psutils or procps (such as ps, w) to     block indefinitely (denial of service) or for some     controlled time (as a synchronization primitive for     other attacks) (bsc#1093158)

  - CVE-2018-1094: The ext4_fill_super function did not     always initialize the crc32c checksum driver, which     allowed attackers to cause a denial of service     (ext4_xattr_inode_hash NULL pointer dereference and     system crash) via a crafted ext4 image (bsc#1087007)

  - CVE-2018-1092: The ext4_iget function mishandled the     case of a root directory with a zero i_links_count,     which allowed attackers to cause a denial of service     (ext4_process_freed_data NULL pointer dereference and     OOPS) via a crafted ext4 image (bsc#1087012)

  - 1093: The ext4_valid_block_bitmap function allowed     attackers to cause a denial of service (out-of-bounds     read and system crash) via a crafted ext4 image because     balloc.c and ialloc.c do not validate bitmap block     numbers (bsc#1087095)

  - CVE-2018-1000200: Prevent NULL pointer dereference which     could have resulted in an out of memory (OOM) killing of     large mlocked processes (bsc#1090150)

  - CVE-2018-1130: NULL pointer dereference in     dccp_write_xmit() function that allowed a local user to     cause a denial of service by a number of certain crafted     system calls (bsc#1092904)

  - CVE-2018-5803: Prevent error in the '_sctp_make_chunk()'     function when handling SCTP packets length that could     have been exploited to cause a kernel crash     (bnc#1083900)

  - CVE-2018-7492: Prevent NULL pointer dereference in the     net/rds/rdma.c __rds_rdma_map() function that allowed     local attackers to cause a system panic and a     denial-of-service, related to RDS_GET_MR and     RDS_GET_MR_FOR_DEST (bsc#1082962)

  - CVE-2018-8781: The udl_fb_mmap function had an     integer-overflow vulnerability allowing local users with     access to the udldrmfb driver to obtain full read and     write permissions on kernel physical pages, resulting in     a code execution in kernel space (bsc#1090643)

  - CVE-2018-10124: The kill_something_info function in     kernel/signal.c might have allowed local users to cause     a denial of service via an INT_MIN argument     (bnc#1089752)

  - CVE-2018-10087: The kernel_wait4 function in     kernel/exit.c might have allowed local users to cause a     denial of service by triggering an attempted use of the

-INT_MIN value (bnc#1089608)

  - CVE-2017-5715: Prevent unauthorized disclosure of     information to an attacker with local user access caused     by speculative execution and indirect branch prediction     (bsc#1068032)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel-alt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-alt packages provide the Linux kernel version 4.x.

Security Fix(es) :

* An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, aarch64)

* A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses.
(CVE-2018-5390)

* A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)

Space precludes documenting all of the security fixes in this advisory. See the descriptions of the remaining security fixes in the related Knowledge Article :

https://access.redhat.com/articles/3658021

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for reporting CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200;
and Wen Xu for reporting CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian Weimer (Red Hat) and Ondrej Mosnacek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

ID	Name	Product	Family	Published	Updated	Severity
112110	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3752-2)	Nessus	Ubuntu Local Security Checks	2018/08/24	2020/09/17	high
112109	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3752-1)	Nessus	Ubuntu Local Security Checks	2018/08/24	2020/09/17	high
112189	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (Azure, GCP, OEM) vulnerabilities (USN-3752-3)	Nessus	Ubuntu Local Security Checks	2018/08/30	2020/09/17	high
123226	openSUSE Security Update : the Linux Kernel (openSUSE-2019-536) (Spectre)	Nessus	SuSE Local Security Checks	2019/03/27	2020/09/22	high
120067	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2092-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/01/02	2021/01/13	high
111414	openSUSE Security Update : the Linux Kernel (openSUSE-2018-762) (Spectre)	Nessus	SuSE Local Security Checks	2018/07/30	2020/06/04	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948) (Spectre)	Nessus	Red Hat Local Security Checks	2018/10/31	2019/10/24	high

Plugins Search