Linux Azure Kernel Vulnerability Fixes (CVE-2018-14625/16882/18407/19407/19854) and Patch Details

Critical Vulnerability Information Vulnerability IDs: - CVE-2018-14625 - CVE-2018-16882 - CVE-2018-18407 - CVE-2018-19407 - CVE-2018-19854 Release Date: February 7, 2019 Affected Package: linux-azure Vulnerability Descriptions: - : A race condition was discovered in the vsock address family implementation, which could lead to a use-after-free condition. A local attacker could exploit this vulnerability within a guest virtual machine to expose sensitive information. - : A use-after-free vulnerability exists in the Linux kernel's KVM implementation when handling interrupts. An attacker could exploit this to gain administrative privileges on the host machine. - : The KVM implementation fails to properly handle socket buffer storage, potentially leading to a buffer overflow. - : A local denial-of-service vulnerability may exist in the KVM Intel (x86) implementation when handling EPT faults, if the guest operating system attempts to establish a user port incorrectly. - : In the Linux kernel, improper cancellation of specific tasks may violate memcg, leading to a local denial-of-service (insider_infoleak_kmem_cgroup). Solution: - Update the system to the following package versions: - : - : 4.18.0-1008.8 - : 4.18.0-1008.9 - After completing standard system updates, a system reboot is required to apply all changes. Additional Notes: - Due to unavoidable ABI changes, the kernel update has been assigned a new version number. All third-party kernel modules must be recompiled and reinstalled. - Standard system upgrades will automatically install the new kernel, provided that the default kernel remnants have not been manually removed. Related Notices: - USN-3901-1, USN-3901-2, USN-3879-1, USN-3879-2, USN-3878-1, USN-3872-1, USN-3872-1...

Goal Reached Thanks to every supporter — we hit 100%!

Linux Azure Kernel Vulnerability Fixes (CVE-2018-14625/16882/18407/19407/19854) and Patch Details