==========================================================================
Kernel Live Patch Security Notice 0042-1
August 14, 2018

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series | Base kernel | Arch | flavors |
|——————+————–+———-+——————|
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |

Summary:

On August 14, fixes for CVE-2018-3620 and CVE-2018-3646 were released into the
Ubuntu Xenial and Bionic kernels. These CVEs are security vulnerabilities
caused by flaws in the design of speculative execution hardware in the
computer’s CPU. Researchers discovered that memory present in the L1 data
cache of an Intel CPU core may be visible to other processes running on the
same core.

Details on the vulnerability and our response can be found here:
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/L1TF

Due to the high complexity of the fixes and the need for a corresponding
CPU microcode update for a complete fix, we are unable to livepatch these
CVEs. Please plan to reboot into an updated kernel as soon as possible.

Software Description:
– linux: Linux kernel

Update instructions:

Users running Ubuntu 18.04 LTS should upgrade to kernel version 4.15.0-32.35
or later.

Users running Ubuntu 16.04 LTS or 14.04 LTS should upgrade to kernel version
4.4.0-133.159 or later.

References:
CVE-2018-3620, and CVE-2018-3646

—