SB2019040253 - Ubuntu update for linux, linux-aws, linux-kvm and more
Published: April 2, 2019 Updated: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 vulnerabilities.
1) Use-after-free error (CVE-ID: CVE-2018-16884)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to bc_svc_process() use wrong back-channel id when NFS41+ shares mounted in different network namespaces at the same time. A remote attacker can use a malicious container to trigger use-after-free error and cause a system panic.
2) NULL pointer dereference (CVE-ID: CVE-2019-9213)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in expand_downwards() in mm/mmap.c that does not check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task. A local user can perform a denial of service (DoS) attack.
3) Memory leak (CVE-ID: CVE-2019-7222)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an adjacent attacker to obtain potentially sensitive information.
The weakness exists due to exists due to memory leak in kvm_inject_page_fault. An adjacent attacker can gain access to important data and conduct further attacks.
4) Use-after-free (CVE-ID: CVE-2019-7221)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an adjacent attacker to cause DoS condition or execute arbitrary code.
The weakness exists due to exists due to use-after-free error when using emulated vmx preemption timer. An adjacent attacker can cause the service to crash or execute arbitrary code with elevated privileges.
5) Race condition (CVE-ID: CVE-2019-6974)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an adjacent attacker to gain elevated privileges or cause a denial of service (DoS) condition.
The weakness exists due to exists due to a race condition that causes the kvm_ioctl_create_device function, as defined in the virt/kvm/kvm_main.c source code file of the affected software, to improperly handle reference counting. An adjacent attacker can access the system and execute an application that submits malicious input, trigger a use-after-free condition and cause a targeted guest virtual machine to crash, resulting in a DoS condition. In addition, a successful exploit could allow the attacker to gain elevated privileges on a targeted system.
6) Infinite loop (CVE-ID: CVE-2019-3819)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists in the function hid_debug_events_read() in drivers/hid/hid-debug.c file due to infinite loop when certain parameters passed from a userspace. A local attacker can execute a specially crafted program that submits malicious input to cause a system lock up and a denial of service.
7) Denial of service (CVE-ID: CVE-2019-3701)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.
The weakness exists in can_can_gw_rcv in net/can/gw.c due to missing check. A local attacker can write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames, trigger general protection fault and cause the system to crash.
8) Memory leak (CVE-ID: CVE-2019-3460)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due heap address infoleak in multiple locations including function l2cap_parse_conf_rsp. A local attacker can trigger memory leak and access important data.
9) Memory leak (CVE-ID: CVE-2019-3459)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due heap address infoleak in use of l2cap_get_conf_opt. A local attacker can trigger memory leak and access important data.
10) Use-after-free (CVE-ID: CVE-2018-9517)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in pppol2tp_connect. A local user can trigger memory corruption and escalate privileges on the system.
11) Race condition (CVE-ID: CVE-2017-18249)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists in the add_free_nid function due to race condition. A local attacker can trigger memory corruption and cause the service to crash.
12) Null pointer dereference (CVE-ID: CVE-2018-14616)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to NULL pointer dereference when the fscrypt_do_page_crypto() function, as defined in the fs/crypto/crypto.c source code file of the affected software, operates on a file in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a malicious F2FS image on a targeted system, operat on a file in the image, and cause the software to crash.
13) Null pointer dereference (CVE-ID: CVE-2018-14614)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to NULL pointer dereference in the __remove_dirty_segment() function, as defined in the source code file fs/f2fs/inode.c when mounting Flash-Friendly File System (F2FS) images. A local attacker can mount a specially crafted F2FS filesystem that submits malicious input and cause the affected software to terminate abnormally.
14) Null pointer dereference (CVE-ID: CVE-2018-14613)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the check_leaf_item() function, as defined in the source code file fs/btrfs/tree-checker.c, due to the affected software improperly validates block group items. A local attacker can mount and operate a specially crafted Btrfs filesystem that submits malicious input, trigger an invalid pointer dereference error in the io_ctl_map_page() function and cause the affected software to terminate abnormally.
15) Null pointer dereference (CVE-ID: CVE-2018-14612)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the btrfs_root_node() function due to insufficient validation of chunk block group mappings in the btrfs_read_block_groups() function (as defined in the fs/btrfs/extent-tree.c source code file of the affected software), as well as insufficient empty-tree checks in the check_leaf() function in the fs/btrfs/tree-checker.c source code file. A local attacker can mount a B-Tree File System (Btrfs) image that submits malicious input, trigger an invalid pointer dereference condition in the btrfs_root_node() function and cause the service to crash.
16) Use-after-free error (CVE-ID: CVE-2018-14611)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to use-after-free error in the btrfs_check_chunk_valid() function, as defined in the source code file fs/btrfs/volumes.c. A local attacker can mount a specially crafted Btrfs filesystem that submits malicious input, trigger memory corruption in the try_merge_free_space() function and cause the affected software to terminate abnormally or execute arbitrary code with elevated privileges..
Successful exploitation of the vulnerability may result in system compromise.
17) Out-of-bounds read (CVE-ID: CVE-2018-14610)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the write_extent_buffer() function due to insufficient verification that each block group has a corresponding chunk at mount time in the btrfs_read_block_groups()function, as defined in fs/btrfs/extent-tree.c source code file. A local attacker can mount and operate a Btrfs filesystem image that submits malicious input, trigger an out-of-bounds read in the write_extent_buffer() function and cause the service to crash.
18) Divide-by-zero (CVE-ID: CVE-2018-13100)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to improper validation of secs_per_zone information in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a specially crafted F2FS image, trigger a divide-by-zero condition in the reset_curseg() function, as defined in the fs/f2fs/super.c source code file and cause the system to crash.
19) Buffer over-read (CVE-ID: CVE-2018-13099)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to an out-of-bounds read in fs/f2fs/inline.c file that occurs for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.
20) Divide by zero (CVE-ID: CVE-2018-13097)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists in the user_block_count() function in the Flash-Friendly File System (F2FS) component, as defined in the source code file fs/f2fs/super.c due to boundary error when mounting F2FS filesystems. A local attacker can access the system and mount an F2FS filesystem that submits malicious input, trigger divide-by-zero memory error and cause the affected software to terminate abnormally.
Remediation
Install update from vendor's website.