==========================================================================
Kernel Live Patch Security Notice 0061-1
January 08, 2020

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series | Base kernel | Arch | flavors |
|——————+————–+———-+——————|
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | aws |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | oem |
| Ubuntu 18.04 LTS | 5.0.0 | amd64 | azure |
| Ubuntu 18.04 LTS | 5.0.0 | amd64 | gcp |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | aws |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | azure |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency |

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895)

It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-14896)

It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-14897)

It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14901)

Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux
kernel did not properly handle reference counting during memory mapping
operations when used in conjunction with AUFS. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-15794)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel | Version | flavors |
|————————–+———-+————————–|
| 4.4.0-168.197 | 61.1 | generic, lowlatency |
| 4.4.0-169.198 | 61.1 | generic, lowlatency |
| 4.4.0-170.199 | 61.1 | lowlatency, generic |
| 4.4.0-1098.109 | 61.1 | aws |
| 4.15.0-69.78 | 61.1 | generic, lowlatency |
| 4.15.0-69.78~16.04.1 | 61.1 | lowlatency, generic |
| 4.15.0-70.79 | 61.1 | lowlatency, generic |
| 4.15.0-70.79~16.04.1 | 61.1 | generic, lowlatency |
| 4.15.0-72.81 | 61.1 | generic, lowlatency |
| 4.15.0-72.81~16.04.1 | 61.1 | generic, lowlatency |
| 4.15.0-1054.56 | 61.1 | aws |
| 4.15.0-1063.68 | 61.1 | azure |
| 4.15.0-1063.72 | 61.1 | oem |
| 4.15.0-1064.73 | 61.1 | oem |
| 4.15.0-1065.75 | 61.1 | oem |
| 5.0.0-1025.26~18.04.1 | 61.1 | gcp |
| 5.0.0-1025.27~18.04.1 | 61.1 | azure |

Support Information:

Kernels older than the levels listed below do not receive livepatch
updates. Please upgrade your kernel as soon as possible.

| Series | Version | Flavors |
|——————+——————+————————–|
| Ubuntu 18.04 LTS | 4.15.0-1054 | aws |
| Ubuntu 16.04 LTS | 4.4.0-1098 | aws |
| Ubuntu 18.04 LTS | 5.0.0-1025 | azure |
| Ubuntu 16.04 LTS | 4.15.0-1063 | azure |
| Ubuntu 18.04 LTS | 4.15.0-69 | generic lowlatency |
| Ubuntu 18.04 LTS | 5.0.0-1025 | gcp |
| Ubuntu 16.04 LTS | 4.15.0-69 | generic lowlatency |
| Ubuntu 14.04 LTS | 4.4.0-168 | generic lowlatency |
| Ubuntu 18.04 LTS | 4.15.0-1063 | oem |
| Ubuntu 16.04 LTS | 4.4.0-168 | generic lowlatency |

References:
CVE-2019-14895, CVE-2019-14896, CVE-2019-14897, CVE-2019-14901,
CVE-2019-15794

—