SB2019030501 - Ubuntu update for Linux kernel (HWE)
Published: March 5, 2019 Updated: March 18, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2018-18397)
The vulnerability allows a local attacker to bypass security restrictions on the target system.
The vulnerability exists due to improper access control in the userfaultfd implementation. A local attacker can access a system that is mounted with shmem or hugetlbs virtual memory areas, maliciously modify mapping to targeted files and write arbitrary memory on the system, which could be used to conduct additional attacks.
2) Memory leak (CVE-ID: CVE-2018-19854)
The vulnerability allows a local attacker to perform DoS attack on the target system.
The vulnerability exists due to crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace. A local attacker can trigger memory leak and perform denial of service attack.
3) Security restrictions bypass (CVE-ID: CVE-2019-6133)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to fork() is not atomic, and therefore authorization decisions are improperly cached, related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c. A remote unauthenticated attacker can bypass the "start time" protection mechanism
Remediation
Install update from vendor's website.