========================================================================== Kernel Live Patch Security Notice LSN-0021-1 April 10, 2017 linux vulnerability ========================================================================== A security issue affects these releases of Ubuntu: | Series | Base kernel | Arch | flavors | |------------------+--------------+----------+------------------| | Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic | | Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency | Summary: Several security issues were fixed in the kernel. Software Description: - linux: Linux kernel Details: Andrey Konovalov discovered that the AF_PACKET implementation in the Linux kernel did not properly validate certain block-size data. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7308) Andrey Konovalov discovered a use-after-free vulnerability in the DCCP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2017-6074) It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges. (CVE-2016-5195) It was discovered that a use-after-free vulnerability existed in the block device layer of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2016-7910) Dmitry Vyukov discovered a use-after-free vulnerability in the sys_ioprio_get() function in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2016-7911) XXX-FIXME-XXX [Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.] (CVE-2016-7912) It was discovered that a race condition existed in the procfs environ_read function in the Linux kernel, leading to an integer underflow. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2016-7916) Qidan He discovered that the ICMP implementation in the Linux kernel did not properly check the size of an ICMP header. A local attacker with CAP_NET_ADMIN could use this to expose sensitive information. (CVE-2016-8399) It was discovered that the KVM implementation for x86/x86_64 in the Linux kernel could dereference a null pointer. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the KVM host. (CVE-2016-8630) Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation in the Linux kernel contained a buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute arbitrary code with administrative privileges. (CVE-2016-8633) CAI Qian discovered that the sysctl implementation in the Linux kernel did not properly perform reference counting in some situations. An unprivileged attacker could use this to cause a denial of service (system hang). (CVE-2016-9191) Andrey Konovalov discovered that the SCTP implementation in the Linux kernel improperly handled validation of incoming data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2016-9555) Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2016-9756) Andy Lutomirski and Willy Tarreau discovered that the KVM implementation in the Linux kernel did not properly emulate instructions on the SS segment register. A local attacker in a guest virtual machine could use this to cause a denial of service (guest OS crash) or possibly gain administrative privileges in the guest OS. (CVE-2017-2583) Update instructions: The problem can be corrected by updating your livepatches to the following versions: | Kernel | Version | flavors | |-----------------+----------+--------------------------| | 4.4.0-21.37 | 16.1 | generic, lowlatency | | 4.4.0-21.37 | 17.1 | generic, lowlatency | | 4.4.0-21.37 | 18.1 | generic, lowlatency | | 4.4.0-21.37 | 21.1 | generic, lowlatency | | 4.4.0-22.39 | 13.2 | generic, lowlatency | | 4.4.0-22.39 | 16.1 | generic, lowlatency | | 4.4.0-22.39 | 17.1 | generic, lowlatency | | 4.4.0-22.39 | 18.1 | generic, lowlatency | | 4.4.0-22.39 | 21.1 | generic, lowlatency | | 4.4.0-22.40 | 16.1 | generic, lowlatency | | 4.4.0-22.40 | 17.1 | generic, lowlatency | | 4.4.0-22.40 | 18.1 | generic, lowlatency | | 4.4.0-22.40 | 21.1 | generic, lowlatency | | 4.4.0-24.43 | 16.1 | generic, lowlatency | | 4.4.0-24.43 | 17.1 | generic, lowlatency | | 4.4.0-24.43 | 18.1 | generic, lowlatency | | 4.4.0-24.43 | 21.1 | generic, lowlatency | | 4.4.0-28.47 | 16.1 | generic, lowlatency | | 4.4.0-28.47 | 17.1 | generic, lowlatency | | 4.4.0-28.47 | 18.1 | generic, lowlatency | | 4.4.0-28.47 | 21.1 | generic, lowlatency | | 4.4.0-31.50 | 16.1 | generic, lowlatency | | 4.4.0-31.50 | 17.1 | generic, lowlatency | | 4.4.0-31.50 | 18.1 | generic, lowlatency | | 4.4.0-31.50 | 21.1 | generic, lowlatency | | 4.4.0-34.53 | 16.1 | generic, lowlatency | | 4.4.0-34.53 | 17.1 | generic, lowlatency | | 4.4.0-34.53 | 18.1 | generic, lowlatency | | 4.4.0-34.53 | 21.1 | generic, lowlatency | | 4.4.0-36.55 | 16.1 | generic, lowlatency | | 4.4.0-36.55 | 17.1 | generic, lowlatency | | 4.4.0-36.55 | 18.1 | generic, lowlatency | | 4.4.0-36.55 | 21.1 | generic, lowlatency | | 4.4.0-38.57 | 16.1 | generic, lowlatency | | 4.4.0-38.57 | 17.1 | generic, lowlatency | | 4.4.0-38.57 | 18.1 | generic, lowlatency | | 4.4.0-38.57 | 21.1 | generic, lowlatency | | 4.4.0-42.62 | 16.1 | generic, lowlatency | | 4.4.0-42.62 | 17.1 | generic, lowlatency | | 4.4.0-42.62 | 18.1 | generic, lowlatency | | 4.4.0-42.62 | 21.1 | generic, lowlatency | | 4.4.0-43.63 | 16.1 | generic, lowlatency | | 4.4.0-43.63 | 17.1 | generic, lowlatency | | 4.4.0-43.63 | 18.1 | generic, lowlatency | | 4.4.0-43.63 | 21.1 | generic, lowlatency | | 4.4.0-45.66 | 16.1 | generic, lowlatency | | 4.4.0-45.66 | 17.1 | generic, lowlatency | | 4.4.0-45.66 | 18.1 | generic, lowlatency | | 4.4.0-45.66 | 21.1 | generic, lowlatency | | 4.4.0-47.68 | 16.1 | generic, lowlatency | | 4.4.0-47.68 | 17.1 | generic, lowlatency | | 4.4.0-47.68 | 18.1 | generic, lowlatency | | 4.4.0-47.68 | 21.1 | generic, lowlatency | | 4.4.0-51.72 | 16.1 | generic, lowlatency | | 4.4.0-51.72 | 17.1 | generic, lowlatency | | 4.4.0-51.72 | 18.1 | generic, lowlatency | | 4.4.0-51.72 | 21.1 | generic, lowlatency | | 4.4.0-53.74 | 16.1 | generic, lowlatency | | 4.4.0-53.74 | 17.1 | generic, lowlatency | | 4.4.0-53.74 | 18.1 | generic, lowlatency | | 4.4.0-53.74 | 21.1 | generic, lowlatency | | 4.4.0-57.78 | 17.1 | generic, lowlatency | | 4.4.0-57.78 | 18.1 | generic, lowlatency | | 4.4.0-57.78 | 21.1 | generic, lowlatency | | 4.4.0-59.80 | 17.1 | generic, lowlatency | | 4.4.0-59.80 | 18.1 | generic, lowlatency | | 4.4.0-59.80 | 21.1 | generic, lowlatency | | 4.4.0-62.83 | 17.1 | generic, lowlatency | | 4.4.0-62.83 | 18.1 | generic, lowlatency | | 4.4.0-62.83 | 21.1 | generic, lowlatency | | 4.4.0-63.84 | 18.1 | generic, lowlatency | | 4.4.0-63.84 | 21.1 | generic, lowlatency | | 4.4.0-64.85 | 21.1 | generic, lowlatency | | 4.4.0-66.87 | 21.1 | generic, lowlatency | | 4.4.0-67.88 | 21.1 | generic, lowlatency | | 4.4.0-70.91 | 21.1 | generic, lowlatency | | 4.4.0-71.92 | 21.1 | generic, lowlatency | Additionally, you should install an updated kernel with these fixes and reboot at your convienience. References: CVE-2016-5195, CVE-2016-7910, CVE-2016-7911, CVE-2016-7912, CVE-2016-7916, CVE-2016-8399, CVE-2016-8630, CVE-2016-8633, CVE-2016-9191, CVE-2016-9555, CVE-2016-9756, CVE-2017-2583, CVE-2017-6074, CVE-2017-7308