Sigurnosni nedostaci jezgre operacijskog sustava

Preporuke

by - 20. svibnja 2020.0

==========================================================================
Ubuntu Security Notice USN-4368-1
May 19, 2020

linux-gke-5.0, linux-oem-osp1 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
– linux-gke-5.0: Linux kernel for Google Container Engine (GKE) systems
– linux-oem-osp1: Linux kernel for OEM systems

Details:

Tristan Madani discovered that the file locking implementation in the Linux
kernel contained a race condition. A local attacker could possibly use this
to cause a denial of service or expose sensitive information.
(CVE-2019-19769)

It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)

It was discovered that the linux kernel did not properly validate certain
mount options to the tmpfs virtual memory file system. A local attacker
with the ability to specify mount options could use this to cause a denial
of service (system crash). (CVE-2020-11565)

It was discovered that the OV51x USB Camera device driver in the Linux
kernel did not properly validate device metadata. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux
kernel did not properly validate device metadata. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the
Linux kernel did not properly validate device metadata. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2020-11668)

David Gibson discovered that the Linux kernel on Power9 CPUs did not
properly save and restore Authority Mask registers state in some
situations. A local attacker in a guest VM could use this to cause a denial
of service (host system crash). (CVE-2020-11669)

It was discovered that the block layer in the Linux kernel contained a race
condition leading to a use-after-free vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2020-12657)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
linux-image-5.0.0-1037-gke 5.0.0-1037.38
linux-image-5.0.0-1052-oem-osp1 5.0.0-1052.57
linux-image-gke-5.0 5.0.0.1037.25
linux-image-oem-osp1 5.0.0.1052.55

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/4368-1
CVE-2019-19769, CVE-2020-11494, CVE-2020-11565, CVE-2020-11608,
CVE-2020-11609, CVE-2020-11668, CVE-2020-11669, CVE-2020-12657

Package Information:
https://launchpad.net/ubuntu/+source/linux-gke-5.0/5.0.0-1037.38
https://launchpad.net/ubuntu/+source/linux-oem-osp1/5.0.0-1052.57

—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAl7ERE8ACgkQLwmejQBe
gfSHSA//cpaMBfw6CvwHZatr2LO+fBsCD/Rb/r6W4THQbQ3L4iQw4rveu7qrTI+3
xOoN7zLcl6bURi/fpuDpqGnNUZfppHvXIXBwCvqHfiZoFrXFxCIsxg9QR76OluoA
CBWMnS5MGzc/36rCPy0B3Ux3hjqSXjhFG27IyS0uABNyiA+fPIGk9YmuWSD7DbUi
2uPF+B/NqlHW+efePIYVEACCjR+6o2peTroAdFglu39valPBO7USbCxOTeXoBFtr
M1H2m9/W+nKQJTON4rpO3qysOxmIETWrSctLy0Awox/ALwzvmFS/ZC/9pumJAEVA
tOXatkOYIsROMhtyqj4ySeORJRw+JeAqD3qwykqFzP8liB0FuM4KXXZLEhNu5Tgl
lEpGrceo3TLvZTa+CqLHgth6KZX0aDdaSUVbH3c7MYCnoVKiiFU29m2f/XtSvand
TE/Zh7jfMzpmH1XCP9Y3FjEADXuFtucGHNN74dKcEduq18GJfWNznrWPbPFzyO7+
PO5fpkstN4YHcyfh87s0lBsCyICNQ31Aiy0nH4/3lRpmABQwT8o9KImv0uVFdD+1
nX7erXlqW0iSl7lquqIxDWeHgkiQPsDs2FyqXH24ZqiEQ1RDuThSZHjBpVgugxU7
ZglAQZ1G0lhvmEQFxhkSYC7YmdXCsfGNpsToTdneRJThkWgkEZw=
=4fIT
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-4367-1
May 19, 2020

linux, linux-aws, linux-gcp, linux-kvm, linux-oracle, linux-riscv
vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
– linux: Linux kernel
– linux-aws: Linux kernel for Amazon Web Services (AWS) systems
– linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
– linux-kvm: Linux kernel for cloud environments
– linux-oracle: Linux kernel for Oracle Cloud systems
– linux-riscv: Linux kernel for RISC-V systems

Details:

It was discovered that the btrfs implementation in the Linux kernel did not
properly detect that a block was marked dirty in some situations. An
attacker could use this to specially craft a file system image that, when
unmounted, could cause a denial of service (system crash). (CVE-2019-19377)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
linux-image-5.4.0-1011-aws 5.4.0-1011.11
linux-image-5.4.0-1011-gcp 5.4.0-1011.11
linux-image-5.4.0-1011-kvm 5.4.0-1011.11
linux-image-5.4.0-1011-oracle 5.4.0-1011.11
linux-image-5.4.0-26-generic 5.4.0-26.30
linux-image-5.4.0-31-generic 5.4.0-31.35
linux-image-5.4.0-31-generic-lpae 5.4.0-31.35
linux-image-5.4.0-31-lowlatency 5.4.0-31.35
linux-image-aws 5.4.0.1011.14
linux-image-gcp 5.4.0.1011.12
linux-image-generic 5.4.0.26.33
linux-image-generic-lpae 5.4.0.31.36
linux-image-gke 5.4.0.1011.12
linux-image-kvm 5.4.0.1011.12
linux-image-lowlatency 5.4.0.31.36
linux-image-oem 5.4.0.31.36
linux-image-oem-osp1 5.4.0.31.36
linux-image-oracle 5.4.0.1011.12
linux-image-virtual 5.4.0.26.33

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://usn.ubuntu.com/4367-1
CVE-2019-19377, CVE-2020-11565, CVE-2020-12657

Package Information:
https://launchpad.net/ubuntu/+source/linux/5.4.0-31.35
https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1011.11
https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1011.11
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1011.11
https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1011.11
https://launchpad.net/ubuntu/+source/linux-riscv/5.4.0-26.30

—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAl7ERDwACgkQLwmejQBe
gfQxnA/8C2wjtXslBYUFXHlqqaADkc4qqAOYPCczd+PHpo2E6KpRCQqVPqq0Hz6u
e8EDu7DgoUzqcIuIwUuQMZ8AbtllEYnLDcnL6MFhauA9vY6EC9JWyFLswmz9qRs5
hIIe53Zyiu8cXMmlEQRAx8PlIhA/SDWq1XqNS+YnO6RYBmTAw5ipJ1mgCSc7OS1w
sDbD7+OuKW/fhbNor0mS3+KWBpwuD9CrdJU0J3I0ne52sybSSF3Sn75j6KqACqta
AE8A4A43djfzoNqvzM9dAohpnpKcKueJiXuVKxsXlsBjgoAQe1mABV/LxwaPyX9b
Yhro0XLwbebDIpQSM2ElKu3GlLIYgVEEhpyKlGh1Ao9YeA9YSIFyEIrshsgqQH0e
UOEjUEcXP5cWZaOja86ASzw4nT+An2lC5qp/hwIm/ghs66Z66dvJLtnLvHCItFxJ
cmTsvo7LEB/Agrx7Pdm138/1nMpxIfy/4pkzh/wQeySFIwquxm54R51BkGMHEusX
b8xpf1eFdO35TqAOFNO46dLoEGtWyusYf5MBjesF0qFr1KaI5XhM6wJqLZ2qLQXn
X7vnQtMkRIyHCz29xR6To5I3Zr8YY8eKHnMb4oH24lHrpKQtPdMjtqwuX932mYzc
8WtsDQbqmVkyVG9TX+RHi2ia+4QkjsB3n0AcnE46R0POdJgfmmY=
=ITsa
—–END PGP SIGNATURE—–
—

Sigurnosni nedostaci jezgre operacijskog sustava

Archives

More in Preporuke

Sigurnosni nedostatak programskog paketa transmission