SB2019100141 - Ubuntu update for linux, linux-aws, linux-kvm and more

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019100141

SB2019100141 - Ubuntu update for linux, linux-aws, linux-kvm and more

Published: October 1, 2019 Updated: October 31, 2026

Security Bulletin ID SB2019100141
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 9% Medium 18% Low 73%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2016-10905)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "fs/gfs2/rgrp.c" file. A local authenticated user can access the system, execute an application that submits malicious input to the affected software, cause a use-after-free condition in the "gfs2_clear_rgrpd" and "read_rindex_entry" functions and execute arbitrary code or cause a DoS condition.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Input validation error (CVE-ID: CVE-2017-18509)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.


3) Double Free (CVE-ID: CVE-2018-20961)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver. A local user can create and run a specially crafted application, trigger double free error and execute arbitrary code on the target system with elevated privileges.


4) Use-after-free (CVE-ID: CVE-2018-20976)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists in "fs/xfs/xfs_super.c" due to a use-after-free error when the "xfs_fs_fill_super" fails. A local authenticated user can execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


5) Resource exhaustion (CVE-ID: CVE-2019-0136)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to the software does not properly control the allocation and maintenance of a limited resource. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

The vulnerability affects Intel Dual Band Wireless-AC 8260 Windows10 Driver


6) NULL pointer dereference (CVE-ID: CVE-2019-10207)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.


7) Resource management error (CVE-ID: CVE-2019-11487)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reference count overflow in page->_refcount that leads to a use-after-free error on systems with more than 140 GiB of RAM. A local user can send specially crafted FUSE requests that may lead to denial of service conditions.

The vulnerability is related to code in fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c files.


8) Out-of-bounds write (CVE-ID: CVE-2019-13631)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to cause an out-of-bounds write condition on a targeted virtual host system.

The vulnerability exists due to the out-of-bounds write error in the "parse_hid_report_descriptor" function in the "drivers/input/tablet/gtco.c" file. A local authenticated attacker can insert a malicious USB device that sends a crafted response to the targeted system and cause an out-of-bounds write condition.

9) Use-after-free (CVE-ID: CVE-2019-15211)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists in the Raremono AM/FM/SW radio device driver in "drivers/media/v4l2-core/v4l2-dev.c" driver due to a use-after-free error when the "drivers/media/radio/radio-raremono.c" does not properly allocate memory. An authenticated local user with physical access to the system can use a malicious USB device to cause a denial of service or possibly execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


10) Use-after-free (CVE-ID: CVE-2019-15215)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the CPiA2 video4linux device driver in the "drivers/media/usb/cpia2/cpia2_usb.c" driver. A local authenticated user with physical access to the system can use a malicious USB device and cause a denial of service (system crash) or possibly execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


11) Out-of-bounds read (CVE-ID: CVE-2019-15926)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c.


Remediation

Install update from vendor's website.

References