Do Son Canonical today released a new kernel security update for the Ubuntu 17.10 (Artful Aardvark) and Ubuntu 16.04 LTS (Xenial Xerus) operating system series to address several recently discovered security vulnerabilities.
For Ubuntu 17.10 (Artful Aardvark), the new security update addresses the bug in the Linux kernel Broadcom UniMAC MDIO bus controller driver (CVE-2018-8043). Due to improper verification of device resources, local attackers can perform DoS attacks on the system.
For Ubuntu 16.04 LTS (Xenial Xerus), the security patch fixes a buffer overflow vulnerability in the keyring subsystem in the Linux kernel (CVE-2017-13305) and an information leak vulnerability in the ACPI Embedded Controller SMBus driver (CVE-2018-5750). Both of these vulnerabilities may allow local attackers to expose sensitive information.
In addition, two race condition issues (CVE-2018-1000004 and CVE-2018-7566) found in the Linux Kernel Advanced Linux Sound Architecture (ALSA) subsystem have also been fixed. This may allow the local attacker to cause the system to deadlock, access /dev/snd/seq, or cause the system to crash.
Finally, this update resolves a security issue (CVE-2017-16538) found in the Linux kernel DM04/QQBOX USB driver. This driver incorrectly handles device connections and warm restarts, allowing physical attackers to execute arbitrary code or crash the system through denial of service.
Canonical has also patched the Ubuntu 16.04 LTS kernel for Microsoft Azure cloud services and Intel Euclid systems, which only contains the issue identified by Jann Horn in the Linux Kernel Berkeley Packet Filter (BPF) (CVE-2017-16995), which may be Allows the local attacker to crash the system or execute arbitrary code.
The Ubuntu 16.04 LTS kernel update for the Microsoft Azure platform addresses a total of 15 security holes, and full details of all fixes can be found here. It is recommended that users update to the linux-image-4.13.0-1014-azure-4.13.0-1014.17 kernel as soon as possible.
Further reading
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
