==========================================================================
Ubuntu Security Notice USN-4364-1
May 18, 2020

linux, linux-aws, linux-lts-xenial, linux-raspi2, linux-snapdragon
vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.04 LTS
– Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
– linux: Linux kernel
– linux-aws: Linux kernel for Amazon Web Services (AWS) systems
– linux-raspi2: Linux kernel for Raspberry Pi (V7) systems
– linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
– linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty

Details:

It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel
did not properly deallocate memory in certain error conditions. A local
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2019-19060)

It was discovered that the vhost net driver in the Linux kernel contained a
stack buffer overflow. A local attacker with the ability to perform ioctl()
calls on /dev/vhost-net could use this to cause a denial of service (system
crash). (CVE-2020-10942)

It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)

It was discovered that the linux kernel did not properly validate certain
mount options to the tmpfs virtual memory file system. A local attacker
with the ability to specify mount options could use this to cause a denial
of service (system crash). (CVE-2020-11565)

It was discovered that the OV51x USB Camera device driver in the Linux
kernel did not properly validate device metadata. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux
kernel did not properly validate device metadata. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the
Linux kernel did not properly validate device metadata. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2020-11668)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
linux-image-4.4.0-1107-aws 4.4.0-1107.118
linux-image-4.4.0-1133-raspi2 4.4.0-1133.142
linux-image-4.4.0-1137-snapdragon 4.4.0-1137.145
linux-image-4.4.0-179-generic 4.4.0-179.209
linux-image-4.4.0-179-generic-lpae 4.4.0-179.209
linux-image-4.4.0-179-lowlatency 4.4.0-179.209
linux-image-4.4.0-179-powerpc-e500mc 4.4.0-179.209
linux-image-4.4.0-179-powerpc-smp 4.4.0-179.209
linux-image-4.4.0-179-powerpc64-emb 4.4.0-179.209
linux-image-4.4.0-179-powerpc64-smp 4.4.0-179.209
linux-image-aws 4.4.0.1107.111
linux-image-generic 4.4.0.179.187
linux-image-generic-lpae 4.4.0.179.187
linux-image-lowlatency 4.4.0.179.187
linux-image-powerpc-e500mc 4.4.0.179.187
linux-image-powerpc-smp 4.4.0.179.187
linux-image-powerpc64-emb 4.4.0.179.187
linux-image-powerpc64-smp 4.4.0.179.187
linux-image-raspi2 4.4.0.1133.133
linux-image-snapdragon 4.4.0.1137.129
linux-image-virtual 4.4.0.179.187

Ubuntu 14.04 ESM:
linux-image-4.4.0-1067-aws 4.4.0-1067.71
linux-image-4.4.0-179-generic 4.4.0-179.209~14.04.1+signed1
linux-image-4.4.0-179-generic-lpae 4.4.0-179.209~14.04.1
linux-image-4.4.0-179-lowlatency 4.4.0-179.209~14.04.1+signed1
linux-image-4.4.0-179-powerpc-e500mc 4.4.0-179.209~14.04.1
linux-image-4.4.0-179-powerpc-smp 4.4.0-179.209~14.04.1
linux-image-4.4.0-179-powerpc64-emb 4.4.0-179.209~14.04.1
linux-image-4.4.0-179-powerpc64-smp 4.4.0-179.209~14.04.1
linux-image-aws 4.4.0.1067.68
linux-image-generic-lpae-lts-xenial 4.4.0.179.158
linux-image-generic-lts-xenial 4.4.0.179.158
linux-image-lowlatency-lts-xenial 4.4.0.179.158
linux-image-powerpc-e500mc-lts-xenial 4.4.0.179.158
linux-image-powerpc-smp-lts-xenial 4.4.0.179.158
linux-image-powerpc64-emb-lts-xenial 4.4.0.179.158
linux-image-powerpc64-smp-lts-xenial 4.4.0.179.158
linux-image-virtual-lts-xenial 4.4.0.179.158

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/4364-1
CVE-2019-19060, CVE-2020-10942, CVE-2020-11494, CVE-2020-11565,
CVE-2020-11608, CVE-2020-11609, CVE-2020-11668

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-179.209
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1107.118
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1133.142
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1137.145

—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAl7DFpkACgkQLwmejQBe
gfSeYQ/9FNEjsaLwHM3bh6plZHFHu9yAsIsYOXov5J+HJ3+7/Oy9R3PFqtD8pHhG
wb4LzJEHoVjDtEdXGpGSSteBtQChg+4XISIEoevq66G7HRGE/tZPlTWJi1d9gjwE
6W09730+QSS+OfforZ2s5Hw3hIe/6hyJ/qM20Ez4TNwZZfRm4oi+G6DJ4mNYvwDC
lVNM56InjSBIwL7Xx9wqEWRZDDhFAF6qbdUYRxZRDKCtCBzeHOUKmFqRplJByeB3
YhZr+3GPubfiFWAlOnUcJJgTf0FiUa4uXCEhKOoqjpR0XnHdliyyludBpa73LVuH
vDgqBYrhE+7erLiuCyMjDg+tU9mQoFGF92enLzn/N4P1wZ8IdZoD83xy7aVcDosq
LLQcXWVcVgW5hBriPHvTvDRQ1PCwhfZ4exAoD3mhf3/wpdboKtxGGMQUnN+xal+i
V2PRQlB2sLXAvWk102ucN7gZJJdHzpLFDZeUQxML+ohEbwYqygb9IuzO8g9h+sKh
17Z6dYZBexPae/PqlB4Hys8NPt1mBznEbH5z+xlOVHPXHW1xyNYqTdlmlQI2cpS7
ARx26ZC2+8jUHu4BN167mMBvUzX0Ug4cxpHsceCj+SuaI/AUpKCJMMLNvh1JJUTl
qh/shfH1Vl2q/tugF83Ox8zmgxjH45sCd/NankxcTBAEMsh9lPI=
=pOuN
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-4363-1
May 18, 2020

linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe,
linux-oem, linux-oracle, linux-snapdragon vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
– linux: Linux kernel
– linux-aws: Linux kernel for Amazon Web Services (AWS) systems
– linux-gke-4.15: Linux kernel for Google Container Engine (GKE) systems
– linux-oem: Linux kernel for OEM systems
– linux-oracle: Linux kernel for Oracle Cloud systems
– linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
– linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
– linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
– linux-hwe: Linux hardware enablement (HWE) kernel

Details:

It was discovered that the Serial CAN interface driver in the Linux kernel
did not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)

It was discovered that the linux kernel did not properly validate certain
mount options to the tmpfs virtual memory file system. A local attacker
with the ability to specify mount options could use this to cause a denial
of service (system crash). (CVE-2020-11565)

David Gibson discovered that the Linux kernel on Power9 CPUs did not
properly save and restore Authority Mask registers state in some
situations. A local attacker in a guest VM could use this to cause a denial
of service (host system crash). (CVE-2020-11669)

It was discovered that the block layer in the Linux kernel contained a race
condition leading to a use-after-free vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2020-12657)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
linux-image-4.15.0-101-generic 4.15.0-101.102
linux-image-4.15.0-101-generic-lpae 4.15.0-101.102
linux-image-4.15.0-101-lowlatency 4.15.0-101.102
linux-image-4.15.0-1039-oracle 4.15.0-1039.43
linux-image-4.15.0-1059-gke 4.15.0-1059.62
linux-image-4.15.0-1067-aws 4.15.0-1067.71
linux-image-4.15.0-1079-snapdragon 4.15.0-1079.86
linux-image-4.15.0-1081-oem 4.15.0-1081.91
linux-image-aws-lts-18.04 4.15.0.1067.70
linux-image-generic 4.15.0.101.91
linux-image-generic-lpae 4.15.0.101.91
linux-image-gke 4.15.0.1059.63
linux-image-gke-4.15 4.15.0.1059.63
linux-image-lowlatency 4.15.0.101.91
linux-image-oem 4.15.0.1081.85
linux-image-oracle-lts-18.04 4.15.0.1039.48
linux-image-powerpc-e500mc 4.15.0.101.91
linux-image-powerpc-smp 4.15.0.101.91
linux-image-powerpc64-emb 4.15.0.101.91
linux-image-powerpc64-smp 4.15.0.101.91
linux-image-snapdragon 4.15.0.1079.82
linux-image-virtual 4.15.0.101.91

Ubuntu 16.04 LTS:
linux-image-4.15.0-101-generic 4.15.0-101.102~16.04.1
linux-image-4.15.0-101-generic-lpae 4.15.0-101.102~16.04.1
linux-image-4.15.0-101-lowlatency 4.15.0-101.102~16.04.1
linux-image-4.15.0-1039-oracle 4.15.0-1039.43~16.04.1
linux-image-4.15.0-1067-aws 4.15.0-1067.71~16.04.1
linux-image-4.15.0-1071-gcp 4.15.0-1071.81~16.04.1
linux-image-aws-hwe 4.15.0.1067.67
linux-image-gcp 4.15.0.1071.77
linux-image-generic-hwe-16.04 4.15.0.101.108
linux-image-generic-lpae-hwe-16.04 4.15.0.101.108
linux-image-gke 4.15.0.1071.77
linux-image-lowlatency-hwe-16.04 4.15.0.101.108
linux-image-oem 4.15.0.101.108
linux-image-oracle 4.15.0.1039.32
linux-image-virtual-hwe-16.04 4.15.0.101.108

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/4363-1
CVE-2020-11494, CVE-2020-11565, CVE-2020-11669, CVE-2020-12657

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-101.102
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1067.71
https://launchpad.net/ubuntu/+source/linux-gke-4.15/4.15.0-1059.62
https://launchpad.net/ubuntu/+source/linux-oem/4.15.0-1081.91
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1039.43
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1079.86
https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1067.71~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1071.81~16.04.1
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-101.102~16.04.1
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1039.43~16.04.1

—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAl7DFo4ACgkQLwmejQBe
gfShHw/+PYAYSe5xCkHB9DmvpWAzUJM54Ra2qMDiTDOveWUBG+6vpZTGDdUQOosB
o44luk/OC5ON2sxSaAL9IsmOVP2ESNER795va+HQj5OoLq1RkFimitZ6olIpMHKy
pTKVSEHy+YNxXRxj8lR3HTZahL8WFhR38U1oM/+xF+Rq8GKwwzkZsevn06TSjXcg
IpIVbLgDrFv9RtQAwTrtjqS0zDC+8RYN6iv7Xu1MqLQVtXusUzI+E1n7ZsuNI4zu
2GejfeyDSc2zhKZhY2/61UBf3JtgUTCvhbQGhu/bPrHr6iaE/PooW+y7I8RvHaqR
l7VH3UjRBf+hA+Py0gI0YbaPAQv1MAHS3T3YdWX0R1FntwcWAdk6rYQkPTaQfrPJ
37OzWsMQvkZAahloOWG+Lb80YDgfa5oBTQRn8A9gpAuGfZSAt/1PNlIVhGXjDksq
aVAqWlmqYnuu5Xe12SwGNW7+9atMKVfkkQxL9+E9s5Xoqqs5DCMaTw0I3EhM383Z
C82CI+O6OrQC3KwMUCCsJmor5Dtnvq8EQUKLCJdXxD1rryIm4W33Mbqxq3yLb0b8
4Ug8FKGjFIymZfeQ9XtIN5WA2gjP7sPlkeo9xQXiSgS0XiMB+wsDImw3cl0DDu0R
fhQIZ2plG4Gkyqz7Jfd4XPq5DaW2m0pUF+Pxe0vlKWzEPh4Joro=
=Gw9F
—–END PGP SIGNATURE—–
—