Ubuntu USN-3775-1: Linux Kernel Spectre v2 Mitigation Bypass & LPE Fixes

Vulnerability Overview Announcement ID: USN-3775-1 Release Date: October 1, 2018 Summary: Multiple security issues in the Linux kernel have been fixed. Affected Versions: 14.04 LTS Vulnerability Details 1. CVE-2018-15594 - A flaw was found in the Linux kernel where improper handling of certain indirect calls reduces the effectiveness of Spectre v2 mitigations against side-channel attacks on virtual machines. A local attacker could exploit this to disclose sensitive information. 2. CVE-2018-15572 - Microprocessors using Return Stack Buffer (RSB) to predict return addresses may allow unauthorized memory reads via side-channel attacks. Attackers could exploit this to disclose sensitive information. 3. CVE-2018-14634 - An integer overflow vulnerability exists during the loading and execution of executable files. A local attacker could exploit this to gain administrative privileges. 4. CVE-2018-6555 - A stack buffer overflow vulnerability exists. Update Instructions These issues can be resolved by updating the system to the following package versions: - Ubuntu Version: 14.04 LTS (trusty) - Package Versions: - : 3.13.0-153.203 - : 3.13.0-153.203 - : 3.13.0-153.203 - : 3.13.0-153.203 Note: Due to unavoidable ABI changes, the kernel update will introduce a new version number, requiring recompilation and reinstallation of all third-party kernel modules. References CVE-2018-6555 CVE-2018-6554 CVE-2018-15594 CVE-2018-15572 CVE-2018-14634 CVE-2018-14633 Related Announcements USN-3777-1 USN-3777-2 USN-3777-3 USN-3776-1 USN-3776-2 USN-3775-2

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-3775-1: Linux Kernel Spectre v2 Mitigation Bypass & LPE Fixes