Executive Summary
| Summary | |
|---|---|
| Title | Linux kernel vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-3821-1 | First vendor Publication | 2018-11-14 |
| Vendor | Ubuntu | Last vendor Modification | 2018-11-14 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.1 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-kvm: Linux kernel for cloud environments - linux-raspi2: Linux kernel for Raspberry Pi 2 - linux-snapdragon: Linux kernel for Snapdragon processors Details: Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly ensure that xattr information remained in inode bodies. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10880) It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053) Wen Xu discovered that the f2fs filesystem implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13096) Wen Xu and Po-Ning Tseng discovered that the btrfs filesystem implementation in the Linux kernel did not properly handle relocations in some situations. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14609) Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617) Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to expose sensitive information. (CVE-2018-17972) It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: Package Information: |
Original Source
| Url : http://www.ubuntu.com/usn/USN-3821-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 25 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
| 25 % | CWE-476 | NULL Pointer Dereference |
| 12 % | CWE-362 | Race Condition |
| 12 % | CWE-190 | Integer Overflow or Wraparound (CWE/SANS Top 25) |
| 12 % | CWE-125 | Out-of-bounds Read |
| 12 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-f392ab8c84.nasl - Type : ACT_GATHER_INFO |
| 2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-ec3bf1b228.nasl - Type : ACT_GATHER_INFO |
| 2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-ddbaca855e.nasl - Type : ACT_GATHER_INFO |
| 2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-9f4381d8c4.nasl - Type : ACT_GATHER_INFO |
| 2019-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2018-50075276e8.nasl - Type : ACT_GATHER_INFO |
| 2018-12-28 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1433.nasl - Type : ACT_GATHER_INFO |
| 2018-11-09 | Name : The remote Amazon Linux 2 host is missing a security update. File : al2_ALAS-2018-1100.nasl - Type : ACT_GATHER_INFO |
| 2018-11-08 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1100.nasl - Type : ACT_GATHER_INFO |
| 2018-10-18 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2018-2_0-0100.nasl - Type : ACT_GATHER_INFO |
| 2018-10-17 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-2ee3411cb8.nasl - Type : ACT_GATHER_INFO |
| 2018-10-11 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-94315e9a6b.nasl - Type : ACT_GATHER_INFO |
| 2018-10-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4313.nasl - Type : ACT_GATHER_INFO |
| 2018-10-04 | Name : The remote Debian host is missing a security update. File : debian_DLA-1531.nasl - Type : ACT_GATHER_INFO |
| 2018-10-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4308.nasl - Type : ACT_GATHER_INFO |
| 2018-09-21 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2018-1_0-0184.nasl - Type : ACT_GATHER_INFO |
| 2018-07-24 | Name : The remote Fedora host is missing a security update. File : fedora_2018-8484550fff.nasl - Type : ACT_GATHER_INFO |
| 2018-07-20 | Name : The remote Debian host is missing a security update. File : debian_DLA-1423.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2018-11-15 05:19:54 |
|
| 2018-11-15 05:17:26 |
|
