==========================================================================
Kernel Live Patch Security Notice 0040-1
July 03, 2018

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series | Base kernel | Arch | flavors |
|——————+————–+———-+——————|
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly handle corrupted meta data in some situations. An
attacker could use this to specially craft an ext4 file system that caused
a denial of service (system crash) when mounted. (CVE-2018-1093)

Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly handle corrupted meta data in some situations. An
attacker could use this to specially craft an ext4 file system that caused
a denial of service (system crash) when mounted. (CVE-2018-1092)

It was discovered that an information leak vulnerability existed in the
floppy driver in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2018-7755)

Julian Stecklina and Thomas Prescher discovered that FPU register states
(such as MMX, SSE, and AVX registers) which are lazy restored are
potentially vulnerable to a side channel attack. A local attacker could use
this to expose sensitive information. (CVE-2018-3665)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel | Version | flavors |
|————————–+———-+————————–|
| 4.4.0-124.148 | 40.6 | lowlatency, generic |
| 4.4.0-124.148~14.04.1 | 40.6 | generic, lowlatency |
| 4.4.0-127.153 | 40.6 | lowlatency, generic |
| 4.4.0-127.153~14.04.1 | 40.6 | lowlatency, generic |
| 4.4.0-128.154 | 40.6 | generic, lowlatency |
| 4.4.0-128.154~14.04.1 | 40.6 | generic, lowlatency |
| 4.15.0-20.21 | 40.7 | generic, lowlatency |
| 4.15.0-22.24 | 40.7 | lowlatency, generic |
| 4.15.0-23.25 | 40.7 | lowlatency, generic |

References:
CVE-2018-1093, CVE-2018-1092, CVE-2018-7755, CVE-2018-3665

—