New Linux kernels security update has been released via Ubuntu Kernel Live Patch
==========================================================================
Kernel Live Patch Security Notice 0061-1
January 08, 2020
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu:
| Series | Base kernel | Arch | flavors | |------------------+--------------+----------+------------------|
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | aws | | Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic | | Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency | | Ubuntu 18.04 LTS | 4.15.0 | amd64 | oem | | Ubuntu 18.04 LTS | 5.0.0 | amd64 | azure | | Ubuntu 18.04 LTS | 5.0.0 | amd64 | gcp | | Ubuntu 16.04 LTS | 4.4.0 | amd64 | aws | | Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic | | Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency | | Ubuntu 16.04 LTS | 4.15.0 | amd64 | azure | | Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic | | Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency |
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14895)
It was discovered that a heap-based buffer overflow existed in the Marvell Libertas WLAN Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14896)
It was discovered that a heap-based buffer overflow existed in the Marvell Libertas WLAN Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14897)
It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14901)
Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux kernel did not properly handle reference counting during memory mapping operations when used in conjunction with AUFS. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15794)
Update instructions:
The problem can be corrected by updating your livepatches to the following versions:
| Kernel | Version | flavors | |--------------------------+----------+--------------------------|
| 4.4.0-168.197 | 61.1 | generic, lowlatency | | 4.4.0-169.198 | 61.1 | generic, lowlatency | | 4.4.0-170.199 | 61.1 | lowlatency, generic | | 4.4.0-1098.109 | 61.1 | aws | | 4.15.0-69.78 | 61.1 | generic, lowlatency | | 4.15.0-69.78~16.04.1 | 61.1 | lowlatency, generic | | 4.15.0-70.79 | 61.1 | lowlatency, generic | | 4.15.0-70.79~16.04.1 | 61.1 | generic, lowlatency | | 4.15.0-72.81 | 61.1 | generic, lowlatency | | 4.15.0-72.81~16.04.1 | 61.1 | generic, lowlatency | | 4.15.0-1054.56 | 61.1 | aws | | 4.15.0-1063.68 | 61.1 | azure | | 4.15.0-1063.72 | 61.1 | oem | | 4.15.0-1064.73 | 61.1 | oem | | 4.15.0-1065.75 | 61.1 | oem | | 5.0.0-1025.26~18.04.1 | 61.1 | gcp | | 5.0.0-1025.27~18.04.1 | 61.1 | azure |
Support Information:
Kernels older than the levels listed below do not receive livepatch updates. Please upgrade your kernel as soon as possible.
| Series | Version | Flavors | |------------------+------------------+--------------------------|
| Ubuntu 18.04 LTS | 4.15.0-1054 | aws | | Ubuntu 16.04 LTS | 4.4.0-1098 | aws | | Ubuntu 18.04 LTS | 5.0.0-1025 | azure | | Ubuntu 16.04 LTS | 4.15.0-1063 | azure | | Ubuntu 18.04 LTS | 4.15.0-69 | generic lowlatency | | Ubuntu 18.04 LTS | 5.0.0-1025 | gcp | | Ubuntu 16.04 LTS | 4.15.0-69 | generic lowlatency | | Ubuntu 14.04 LTS | 4.4.0-168 | generic lowlatency | | Ubuntu 18.04 LTS | 4.15.0-1063 | oem | | Ubuntu 16.04 LTS | 4.4.0-168 | generic lowlatency |
References:
CVE-2019-14895, CVE-2019-14896, CVE-2019-14897, CVE-2019-14901, CVE-2019-15794
