SB2019090230 - Ubuntu update for linux, linux-azure, linux-gcp and more

Description

This security bulletin contains information about 28 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2019-15090)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists in the QLogic QEDI iSCSI Initiator Driver due to a boundary condition in "drivers/scsi/qedi/qedi_dbg.c". A local authenticated user can trigger out-of-bounds read error and read contents of memory on the system.

2) Cryptographic issues (CVE-ID: CVE-2019-9506)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to a weakness in Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) protocol core specification that allows an attacker with close proximity to the affected system to perform a man-in-the-middle attack on an encrypted Bluetooth connection.

Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information or perform unauthorized actions.

3) Infinite loop (CVE-ID: CVE-2019-3900)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in vhost_net kernel module when processing incoming packets in handle_rx(). A remote attacker with access to guest operating system can stall the vhost_net kernel thread and cause denial of service conditions.

4) Infinite loop (CVE-ID: CVE-2019-3819)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the function hid_debug_events_read() in drivers/hid/hid-debug.c file due to infinite loop when certain parameters passed from a userspace. A local attacker can execute a specially crafted program that submits malicious input to cause a system lock up and a denial of service.

5) Denial of service (CVE-ID: CVE-2019-3701)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in can_can_gw_rcv in net/can/gw.c due to missing check. A local attacker can write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames, trigger general protection fault and cause the system to crash.

6) Use-after-free (CVE-ID: CVE-2019-15292)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists in the "atalk_proc_exit" due to a use-after-free error, related to "net/appletalk/atalk_proc.c", "net/appletalk/ddp.c" and "net/appletalk/sysctl_net_atalk.c". A remote attacker can execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

7) NULL pointer dereference (CVE-ID: CVE-2019-15221)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in sound/usb/line6/pcm.c driver. A local user can perform a denial of service (DoS) attack using a malicious USB device.

8) Use-after-free (CVE-ID: CVE-2019-15220)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to use-after-free error in the drivers/net/wireless/intersil/p54/p54usb.c driver. A local user can use a malicious USB device to trigger use-after-free error and execute arbitrary code on the system with elevated privileges.

9) NULL pointer dereference (CVE-ID: CVE-2019-15218)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the "drivers/media/usb/siano/smsusb.c" file. A local attacker with physical access can insert a USB device that submits malicious input to the targeted system and cause a denial of service (DoS) condition.

10) NULL pointer dereference (CVE-ID: CVE-2019-15216)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in drivers/usb/misc/yurex.c driver. A local user can use a malicious USB device to perform denial of service (DoS) attack.

11) Use-after-free (CVE-ID: CVE-2019-15215)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the CPiA2 video4linux device driver in the "drivers/media/usb/cpia2/cpia2_usb.c" driver. A local authenticated user with physical access to the system can use a malicious USB device and cause a denial of service (system crash) or possibly execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

12) Use-after-free (CVE-ID: CVE-2019-15214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists in the Advanced Linux Sound Architecture (ALSA) subsystem in "sound/core/init.c" and "sound/core/info.c" due to the card disconnection causes certain data structures to be deleted too early. A local authenticated user with physical access to the system can exploit this vulnerability to cause a denial of service (system crash) or possibly execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

13) Double Free (CVE-ID: CVE-2019-15212)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists in the USB Rio 500 device driver due to a boundary error in the "drivers/usb/misc/rio500.c" driver. A local authenticated user with physical access can use a malicious USB device, trigger double free error and cause a denial of service condition on the target system.

14) Use-after-free (CVE-ID: CVE-2019-15211)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists in the Raremono AM/FM/SW radio device driver in "drivers/media/v4l2-core/v4l2-dev.c" driver due to a use-after-free error when the "drivers/media/radio/radio-raremono.c" does not properly allocate memory. An authenticated local user with physical access to the system can use a malicious USB device to cause a denial of service or possibly execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

15) Out-of-bounds read (CVE-ID: CVE-2018-19985)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when the function "hso_get_config_data" in "drivers/net/usb/hso.c" reads "if_num" from the USB device (as a u8) and uses it to index a small array. An authenticated local user with physical access to the system can use a malicious USB, trigger out-of-bounds read error and read contents of memory on the system.

16) Improper locking (CVE-ID: CVE-2019-14763)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to double-locking error in the DesignWare USB3 DRD Controller device in "drivers/usb/dwc3/gadget.c". An authenticated local user with physical access to the system can exploit this vulnerability to cause a deadlock with "f_hid", resulting in a denial of service condition.

17) Resource exhaustion (CVE-ID: CVE-2019-14284)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a divide-by-zero condition in the "drivers/block/floppy.c" file. A local authenticated attacker can insert a floppy disk that submits malicious input to the targeted system, trigger resource exhaustion and perform a denial of service (DoS) attack.

18) Integer overflow (CVE-ID: CVE-2019-14283)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to the "set_geometry" function in the "drivers/block/floppy.c" file does not properly validate the sect and head fields. A local authenticated attacker can insert a floppy disk that submits malicious input to the targeted system, trigger integer overflow, which could cause an out-of-bounds write condition and execute arbitrary code on the target system or cause a DoS condition.

19) Resource management error (CVE-ID: CVE-2019-13648)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the "arch/powerpc/kernel/signal_32.c" and "arch/powerpc/kernel/signal_64.c" files on the PowerPC platform, when hardware transactional memory is disabled. A local authenticated attacker can make a "sigreturn()" system call that sends a signal frame that sends a signal frame that submits malicious input to the targeted system and cause a denial of service condition.

20) Out-of-bounds write (CVE-ID: CVE-2019-13631)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

21) NULL pointer dereference (CVE-ID: CVE-2019-11810)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. A local user can perform a denial of service (DoS) attack.

22) Race condition (CVE-ID: CVE-2019-11599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition with mmget_not_zero or get_task_mm calls and is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c due to kernel does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

23) Resource management error (CVE-ID: CVE-2019-11487)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reference count overflow in page->_refcount that leads to a use-after-free error on systems with more than 140 GiB of RAM. A local user can send specially crafted FUSE requests that may lead to denial of service conditions.

The vulnerability is related to code in fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c files.

24) Information disclosure (CVE-ID: CVE-2019-10639)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the possibility to extract the Kernel Address Space Layout Randomization (KASLR) kernel image offset of the affected software using the IP ID values that the kernel produces for connectionless protocols. A remote attacker can force the targeted system to send UDP or ICMP traffic to an attacker-controlled IP address and gain unauthorized access to sensitive information on the system.

25) Information disclosure (CVE-ID: CVE-2019-10638)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the software uses the IP ID values that the kernel produces for connectionless protocols. A remote attacker with a crafted web page can forge the targeted system to send UDP traffic to an attacker-controlled IP address to gain unauthorized access to sensitive information on the system.

26) NULL pointer dereference (CVE-ID: CVE-2019-10207)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.

27) Resource exhaustion (CVE-ID: CVE-2019-0136)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to the software does not properly control the allocation and maintenance of a limited resource. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

The vulnerability affects Intel Dual Band Wireless-AC 8260 Windows10 Driver

28) Resource exhaustion (CVE-ID: CVE-2018-20784)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in resource management within the update_blocked_averages function in kernel/sched/fair.c when processing leaf cfs_rq's. A local user can cause resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4115-1