SB2019081389 - Ubuntu update for linux, linux-azure, linux-gcp and more

Description

This security bulletin contains information about 32 vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2018-16862)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The vulnerability exists due to an error when the cleancache subsystem clears an inode after the final file truncation (removal). A local attacker can supply new file created with the same inode that may contain leftover pages from cleancache and bypass security restrictions to conduct further attacks.

2) Buffer overflow (CVE-ID: CVE-2019-3846)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.

3) Out-of-bounds read (CVE-ID: CVE-2019-2101)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.

4) Use-after-free (CVE-ID: CVE-2019-2024)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References: Upstream kernel

5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-13272) Exploited

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

6) Use-after-free (CVE-ID: CVE-2019-13233)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the arch/x86/lib/insn-eval.c file due to a race condition between modify_ldt() and a #BR exception for an MPX bounds violation when accessing LDT entry. A local user can create a specially crafted application and escalate privileges on the system.

7) NULL pointer dereference (CVE-ID: CVE-2019-12984)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the "nfc_genl_deactivate_target()" function in "net/nfc/netlink.c" file. An attacker with physical access to the system can persuade a user to execute an application that omits certain near-field communication (NFC) attributes and perform a denial of service (DoS) attack.

8) Use-after-free (CVE-ID: CVE-2019-12819)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the __mdiobus_register() function in drivers/net/phy/mdio_bus.c. A local user can perform a denial of service (DoS) attack.

9) NULL pointer dereference (CVE-ID: CVE-2019-12818)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in the Linux kernel before 4.20.15 when processing NFC data. The error is triggered by the  nfc_llcp_build_tlv function in net/nfc/llcp_commands.c that may return NULL. Such behavior can lead to a NULL pointer dereference in the nfc_llcp_build_gb() function in net/nfc/llcp_core.c. A remote attacker can perform a denial of service (DoS) attack.

10) NULL pointer dereference (CVE-ID: CVE-2019-12614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c due to  kstrdup of prop->name. A local user can perform a denial of service (DoS) attack.

11) Information disclosure (CVE-ID: CVE-2019-1125)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to potentially sensitive information and elevate privileges on the system.

The vulnerability exists when certain central processing units (CPU) speculatively access memory. A local user can gain unauthorized access to sensitive information and elevate privileges on the system.

This issue is a variant of the Spectre Variant 1 speculative execution side channel vulnerability that leverages SWAPGS instructions to bypass KPTI/KVA mitigations.

12) Heap-based buffer overflow (CVE-ID: CVE-2019-10126)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) condition or execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the Marvell Wireless LAN device driver in "mwifiex_uap_parse_tail_ies" function in "drivers/net/wireless/marvell/mwifiex/ie.c". A local authenticated user can trigger heap-based buffer overflow and cause a denial of service (system crash) or possibly execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

13) Man-in-the-middle attack (CVE-ID: CVE-2018-5383)

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an adjacent attacker to conduct man-in-the-middle attack on the target system.

The weakness exists in the Bluetooth Low Energy (BLE) implementation of Secure Connections mode insufficient validation of elliptic curve parameters that are used to generate public keys during a Diffie-Hellman key exchange when the affected software performs device pairing operations. An adjacent attacker can intercept the public key exchange between the two targeted systems, inject a malicious public key to aid in determining the session key,  access sensitive information or forge and modify messages, which could be used to inject malicious software on the targeted system. 

14) Use-after-free (CVE-ID: CVE-2018-20856)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to execute arbitrary code on a targeted system.

The vulnerability exists due to a use-after-free error when the "__blk_drain_queue()" function in the "block/blk-core.c" file mishandles error cases. A local authenticated attacker can access the system and execute an application that submits malicious input, cause a use-after-free memory operation error and execute arbitrary code on the targeted system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

15) Information disclosure (CVE-ID: CVE-2018-20511)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in ipddp_ioctl function in drivers/net/appletalk/ipddp.c. A remote attacker can leverage CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.

16) Memory corruption (CVE-ID: CVE-2018-20169)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists in the USB subsystem due to improper checks on the minimum and maximum size of data allowed when reading an extra descriptor by the USB subsystem of the affected software, related to the __usb_get_extra_descriptor in the drivers/usb/core/usb.c source code file. A local attacker can insert a USB device designed to submit malicious input, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

17) Integer overflow (CVE-ID: CVE-2018-13053)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in kernel/time/alarmtimer.c within the alarm_timer_nsleep function. A local user can trigger integer overflow due to ktime_add_safe is not used and escalate privileges on the system.

18) Null pointer dereference (CVE-ID: CVE-2018-14617)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference when the hfsplus_lookup() function, as defined in the fs/hfsplus/dir.c source code file of the affected software, opens a file in a read-only Hierarchical File System Plus (HFS+) filesystem without a metadata directory and with malformed catalog data. A local attacker can mount a malicious HFS+ filesystem image, open a file in the image and cause kernel panic.

19) Null pointer dereference (CVE-ID: CVE-2018-14616)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference when the fscrypt_do_page_crypto() function, as defined in the fs/crypto/crypto.c source code file of the affected software, operates on a file in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a malicious F2FS image on a targeted system, operat on a file in the image, and cause the software to crash.

20) Buffer overflow (CVE-ID: CVE-2018-14615)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the truncate_inline_inode() function, as defined in the fs/f2fs/inline.c source code file of the affected software due to a length value may be negative during unmounting operations on a Flash-Friendly File System (F2FS) image. A local attacker can unmount an F2FS image, trigger a buffer overflow condition and cause the service to crash.

21) Null pointer dereference (CVE-ID: CVE-2018-14614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the __remove_dirty_segment() function, as defined in the source code file fs/f2fs/inode.c when mounting Flash-Friendly File System (F2FS) images. A local attacker can mount a specially crafted F2FS filesystem that submits malicious input and cause the affected software to terminate abnormally.

22) Null pointer dereference (CVE-ID: CVE-2018-14613)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the check_leaf_item() function, as defined in the source code file fs/btrfs/tree-checker.c, due to the affected software improperly validates block group items. A local attacker can mount and operate a specially crafted Btrfs filesystem that submits malicious input, trigger an invalid pointer dereference error in the io_ctl_map_page() function and cause the affected software to terminate abnormally.

23) Null pointer dereference (CVE-ID: CVE-2018-14612)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the btrfs_root_node() function due to insufficient validation of chunk block group mappings in the btrfs_read_block_groups() function (as defined in the fs/btrfs/extent-tree.c source code file of the affected software), as well as insufficient empty-tree checks in the check_leaf() function in the fs/btrfs/tree-checker.c source code file. A local attacker can mount a B-Tree File System (Btrfs) image that submits malicious input, trigger an invalid pointer dereference condition in the btrfs_root_node() function and cause the service to crash.

24) Use-after-free error (CVE-ID: CVE-2018-14611)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to use-after-free error in the btrfs_check_chunk_valid() function, as defined in the source code file fs/btrfs/volumes.c. A local attacker can mount a specially crafted Btrfs filesystem that submits malicious input, trigger memory corruption in the try_merge_free_space() function and cause the affected software to terminate abnormally or execute arbitrary code with elevated privileges..

Successful exploitation of the vulnerability may result in system compromise.

25) Out-of-bounds read (CVE-ID: CVE-2018-14610)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the write_extent_buffer() function due to insufficient verification that each block group has a corresponding chunk at mount time in the btrfs_read_block_groups()function, as defined in fs/btrfs/extent-tree.c source code file. A local attacker can mount and operate a Btrfs filesystem image that submits malicious input, trigger an out-of-bounds read in the write_extent_buffer() function and cause the service to crash.

26) Null pointer dereference (CVE-ID: CVE-2018-14609)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the __del_reloc_root() function, as defined in the fs/btrfs/relocation.c source code file of the affected software due to an invalid pointer dereference condition that could occur when a corrupted Btrfs filesystem image is mounted. A local attacker can mount a Btrfs image that submits malicious input, trigger an invalid pointer dereference condition and cause the service to crash.

27) Divide-by-zero (CVE-ID: CVE-2018-13100)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to improper validation of secs_per_zone information in a corrupted Flash-Friendly File System (F2FS) image. A local attacker can mount a specially crafted F2FS image, trigger a divide-by-zero condition in the reset_curseg() function, as defined in the fs/f2fs/super.c source code file and cause the system to crash.

28) Buffer over-read (CVE-ID: CVE-2018-13099)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an out-of-bounds read in fs/f2fs/inline.c file that occurs for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.

29) Buffer over-read (CVE-ID: CVE-2018-13098)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an out-of-bounds read in fs/f2fs/inode.c file that occurs for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set in an inode.

30) Divide by zero (CVE-ID: CVE-2018-13097)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the user_block_count() function in the Flash-Friendly File System (F2FS) component, as defined in the source code file fs/f2fs/super.c due to boundary error when mounting F2FS filesystems. A local attacker can access the system and mount an F2FS filesystem that submits malicious input, trigger divide-by-zero memory error and cause the affected software to terminate abnormally.

31) Out-of-bounds read (CVE-ID: CVE-2018-13096)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the build_sit_info() function in the Flash-Friendly File System (F2FS) component, as defined in the source code file fs/f2fs/super.c due to boundary error when mounting F2FS filesystems. A local attacker can access the system and mount an F2FS filesystem that submits malicious input in an abnormal bitmap size, trigger out-of-bounds memory read and cause the affected software to terminate abnormally.

32) Null pointer dereference (CVE-ID: CVE-2018-13093)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the lookup_slow() function in the Extended File System (XFS) component, as defined in the source code file fs/xfs/xfs_icache.c due to boundary error when mounting XFS filesystems. A local attacker can mount an XFS filesystem that submits malicious input, trigger NULL pointer dereference memory error and cause the affected software to terminate abnormally.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4094-1