[USN-4285-1] Linux kernel vulnerabilities

Severity Medium

Affected Packages 10

CVEs 12

Several security issues were fixed in the Linux kernel.

It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)

It was discovered that the HSA Linux kernel driver for AMD GPU devices did
not properly check for errors in certain situations, leading to a NULL
pointer dereference. A local attacker could possibly use this to cause a
denial of service. (CVE-2019-16229)

It was discovered that the Marvell 8xxx Libertas WLAN device driver in the
Linux kernel did not properly check for errors in certain situations,
leading to a NULL pointer dereference. A local attacker could possibly use
this to cause a denial of service. (CVE-2019-16232)

It was discovered that the Renesas Digital Radio Interface (DRIF) driver in
the Linux kernel did not properly initialize data. A local attacker could
possibly use this to expose sensitive information (kernel memory).
(CVE-2019-18786).

It was discovered that the Afatech AF9005 DVB-T USB device driver in the
Linux kernel did not properly deallocate memory in certain error
conditions. A local attacker could possibly use this to cause a denial of
service (kernel memory exhaustion). (CVE-2019-18809)

It was discovered that multiple memory leaks existed in the Marvell WiFi-Ex
Driver for the Linux kernel. A local attacker could possibly use this to
cause a denial of service (kernel memory exhaustion). (CVE-2019-19057)

It was discovered that the Realtek rtlwifi USB device driver in the Linux
kernel did not properly deallocate memory in certain error conditions. A
local attacker could possibly use this to cause a denial of service (kernel
memory exhaustion). (CVE-2019-19063)

It was discovered that the Kvaser CAN/USB driver in the Linux kernel did
not properly initialize memory in certain situations. A local attacker
could possibly use this to expose sensitive information (kernel memory).
(CVE-2019-19947)

Gao Chuan discovered that the SAS Class driver in the Linux kernel
contained a race condition that could lead to a NULL pointer dereference. A
local attacker could possibly use this to cause a denial of service (system
crash). (CVE-2019-19965)

It was discovered that the Datagram Congestion Control Protocol (DCCP)
implementation in the Linux kernel did not properly deallocate memory in
certain error conditions. An attacker could possibly use this to cause a
denial of service (kernel memory exhaustion). (CVE-2019-20096)

Mitchell Frank discovered that the Wi-Fi implementation in the Linux kernel
when used as an access point would send IAPP location updates for stations
before client authentication had completed. A physically proximate attacker
could use this to cause a denial of service. (CVE-2019-5108)

It was discovered that a race condition can lead to a use-after-free while
destroying GEM contexts in the i915 driver for the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-7053)

Package	Affected Version
pkg:deb/ubuntu/linux-image-oracle-edge?distro=bionic	< 5.0.0.1011.10
pkg:deb/ubuntu/linux-image-gke-5.0?distro=bionic	< 5.0.0.1030.18
pkg:deb/ubuntu/linux-image-gcp?distro=bionic	< 5.0.0.1031.35
pkg:deb/ubuntu/linux-image-azure?distro=bionic	< 5.0.0.1032.43
pkg:deb/ubuntu/linux-image-aws-edge?distro=bionic	< 5.0.0.1025.39
pkg:deb/ubuntu/linux-image-5.0.0-1032-azure?distro=bionic	< 5.0.0-1032.34
pkg:deb/ubuntu/linux-image-5.0.0-1031-gcp?distro=bionic	< 5.0.0-1031.32
pkg:deb/ubuntu/linux-image-5.0.0-1030-gke?distro=bionic	< 5.0.0-1030.31
pkg:deb/ubuntu/linux-image-5.0.0-1025-aws?distro=bionic	< 5.0.0-1025.28
pkg:deb/ubuntu/linux-image-5.0.0-1011-oracle?distro=bionic	< 5.0.0-1011.16

ID

USN-4285-1

Severity

medium

URL

https://ubuntu.com/security/notices/USN-4285-1

Published

2020-02-18T19:35:31
(4 years ago)

Modified

2020-02-18T19:35:31
(4 years ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/linux-image-oracle-edge?distro=bionic	ubuntu	linux-image-oracle-edge	< 5.0.0.1011.10	bionic
Affected	pkg:deb/ubuntu/linux-image-gke-5.0?distro=bionic	ubuntu	linux-image-gke-5.0	< 5.0.0.1030.18	bionic
Affected	pkg:deb/ubuntu/linux-image-gcp?distro=bionic	ubuntu	linux-image-gcp	< 5.0.0.1031.35	bionic
Affected	pkg:deb/ubuntu/linux-image-azure?distro=bionic	ubuntu	linux-image-azure	< 5.0.0.1032.43	bionic
Affected	pkg:deb/ubuntu/linux-image-aws-edge?distro=bionic	ubuntu	linux-image-aws-edge	< 5.0.0.1025.39	bionic
Affected	pkg:deb/ubuntu/linux-image-5.0.0-1032-azure?distro=bionic	ubuntu	linux-image-5.0.0-1032-azure	< 5.0.0-1032.34	bionic
Affected	pkg:deb/ubuntu/linux-image-5.0.0-1031-gcp?distro=bionic	ubuntu	linux-image-5.0.0-1031-gcp	< 5.0.0-1031.32	bionic
Affected	pkg:deb/ubuntu/linux-image-5.0.0-1030-gke?distro=bionic	ubuntu	linux-image-5.0.0-1030-gke	< 5.0.0-1030.31	bionic
Affected	pkg:deb/ubuntu/linux-image-5.0.0-1025-aws?distro=bionic	ubuntu	linux-image-5.0.0-1025-aws	< 5.0.0-1025.28	bionic
Affected	pkg:deb/ubuntu/linux-image-5.0.0-1011-oracle?distro=bionic	ubuntu	linux-image-5.0.0-1011-oracle	< 5.0.0-1011.16	bionic

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date