Pivotal + VMware: Transforming how more of the world builds software

All Vulnerability Reports

USN-3879-2: Linux kernel (Xenial HWE) vulnerabilities


Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected
  • Canonical Ubuntu 14.04
Description

USN-3879-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.

Wen Xu discovered that the ext4 file system implementation in the Linux kernel could possibly perform an out of bounds write when updating the journal for an inline file. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10883)

Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not properly initialize new files in some situations. A local attacker could use this to expose sensitive information. (CVE-2018-16862)

Wei Wu discovered that the KVM implementation in the Linux kernel did not properly ensure that ioapics were initialized. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-19407)

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-20169)

CVEs contained in this USN include: CVE-2018-10883, CVE-2018-19407, CVE-2018-16862, CVE-2018-19824, CVE-2018-20169

Affected Pivotal Products and Versions

Severity is medium unless otherwise noted.

  • Vulnerable Cloud Foundry components individually listed here.
  • Impacted stemcells may be updated independently of upgrading Pivotal Application Service or PCF Isolation Segment.
  • Pivotal Application Service includes vulnerable stemcells in the following releases:
    • 2.2.x versions prior to 2.2.13
  • PCF Isolation Segment includes vulnerable stemcells in the following releases:
    • 2.2.x versions prior to 2.2.13
  • Pivotal Operations Manager is vulnerable in the following releases:
    • 2.2.x versions prior to 2.2.18
Mitigation

Users of affected versions should apply the following mitigation:

  • The Cloud Foundry security team recommends upgrading BOSH to the affected OSS components listed here if applicable.
  • Upgrade Pivotal products that use earlier versions of CF components to new Pivotal releases using new versions linked above. On the Pivotal Network product page for each release, check the Depends On section and/or Release Notes for this information.
  • Releases that have fixed this issue include:
    • Pivotal Application Service: 2.2.13
    • PCF Isolation Segment: 2.2.13
    • Pivotal Operations Manager: 2.2.18
References
Contact us