USN-4525-1: Linux kernel vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• linux - Linux kernel
• linux-aws - Linux kernel for Amazon Web Services (AWS) systems
• linux-aws-5.4 - Linux kernel for Amazon Web Services (AWS) systems
• linux-azure - Linux kernel for Microsoft Azure Cloud systems
• linux-azure-5.4 - Linux kernel for Microsoft Azure cloud systems
• linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
• linux-gcp-5.4 - Linux kernel for Google Cloud Platform (GCP) systems
• linux-hwe-5.4 - Linux hardware enablement (HWE) kernel
• linux-kvm - Linux kernel for cloud environments
• linux-oracle - Linux kernel for Oracle Cloud systems
• linux-oracle-5.4 - Linux kernel for Oracle Cloud systems
• linux-raspi - Linux kernel for Raspberry Pi (V8) systems
• linux-raspi-5.4 - Linux kernel for Raspberry Pi (V8) systems

Details

It was discovered that the AMD Cryptographic Coprocessor device driver in
the Linux kernel did not properly deallocate memory in some situations. A
local attacker could use this to cause a denial of service (memory
exhaustion). (CVE-2019-18808)

It was discovered that the Conexant 23885 TV card device driver for the
Linux kernel did not properly deallocate memory in some error conditions. A
local attacker could use this to cause a denial of service (memory
exhaustion). (CVE-2019-19054)

It was discovered that the VFIO PCI driver in the Linux kernel did not
properly handle attempts to access disabled memory spaces. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2020-12888)

It was discovered that the state of network RNG in the Linux kernel was
potentially observable. A remote attacker could use this to expose
sensitive information. (CVE-2020-16166)

It was discovered that the NFS client implementation in the Linux kernel
did not properly perform bounds checking before copying security labels in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• linux-image-5.4.0-1019-raspi - 5.4.0-1019.21
• linux-image-5.4.0-1024-kvm - 5.4.0-1024.24
• linux-image-5.4.0-1025-aws - 5.4.0-1025.25
• linux-image-5.4.0-1025-gcp - 5.4.0-1025.25
• linux-image-5.4.0-1025-oracle - 5.4.0-1025.25
• linux-image-5.4.0-1026-azure - 5.4.0-1026.26
• linux-image-5.4.0-48-generic - 5.4.0-48.52
• linux-image-5.4.0-48-generic-lpae - 5.4.0-48.52
• linux-image-5.4.0-48-lowlatency - 5.4.0-48.52
• linux-image-aws - 5.4.0.1025.26
• linux-image-azure - 5.4.0.1026.25
• linux-image-gcp - 5.4.0.1025.22
• linux-image-generic - 5.4.0.48.51
• linux-image-generic-lpae - 5.4.0.48.51
• linux-image-gke - 5.4.0.1025.22
• linux-image-kvm - 5.4.0.1024.22
• linux-image-lowlatency - 5.4.0.48.51
• linux-image-oem - 5.4.0.48.51
• linux-image-oem-osp1 - 5.4.0.48.51
• linux-image-oracle - 5.4.0.1025.22
• linux-image-raspi - 5.4.0.1019.54
• linux-image-raspi2 - 5.4.0.1019.54
• linux-image-virtual - 5.4.0.48.51

Ubuntu 18.04

• linux-image-5.4.0-1019-raspi - 5.4.0-1019.21~18.04.1
• linux-image-5.4.0-1025-aws - 5.4.0-1025.25~18.04.1
• linux-image-5.4.0-1025-gcp - 5.4.0-1025.25~18.04.1
• linux-image-5.4.0-1025-oracle - 5.4.0-1025.25~18.04.1
• linux-image-5.4.0-1026-azure - 5.4.0-1026.26~18.04.1
• linux-image-5.4.0-48-generic - 5.4.0-48.52~18.04.1
• linux-image-5.4.0-48-generic-lpae - 5.4.0-48.52~18.04.1
• linux-image-5.4.0-48-lowlatency - 5.4.0-48.52~18.04.1
• linux-image-aws - 5.4.0.1025.10
• linux-image-azure - 5.4.0.1026.9
• linux-image-gcp - 5.4.0.1025.13
• linux-image-generic-hwe-18.04 - 5.4.0.48.52~18.04.42
• linux-image-generic-lpae-hwe-18.04 - 5.4.0.48.52~18.04.42
• linux-image-lowlatency-hwe-18.04 - 5.4.0.48.52~18.04.42
• linux-image-oracle - 5.4.0.1025.9
• linux-image-raspi-hwe-18.04 - 5.4.0.1019.23
• linux-image-snapdragon-hwe-18.04 - 5.4.0.48.52~18.04.42
• linux-image-virtual-hwe-18.04 - 5.4.0.48.52~18.04.42

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

• CVE-2019-18808
• CVE-2019-19054
• CVE-2020-12888
• CVE-2020-16166
• CVE-2020-25212

Related notices

• USN-4526-1: linux-image-4.15.0-1083-aws, linux-image-4.15.0-118-generic-lpae, linux-image-gke, linux-hwe, linux-image-generic-lpae-hwe-16.04-edge, linux-image-lowlatency-hwe-16.04-edge, linux-image-oem, linux-image-lowlatency, linux-image-azure, linux-image-4.15.0-1096-azure, linux-image-oracle-lts-18.04, linux-image-aws-hwe, linux-image-azure-edge, linux-image-generic-hwe-16.04, linux-image-4.15.0-118-generic, linux-image-snapdragon, linux-image-gcp-lts-18.04, linux-image-4.15.0-1075-kvm, linux-oem, linux-gcp, linux-image-virtual, linux-gke-4.15, linux-image-4.15.0-1071-raspi2, linux-image-4.15.0-1084-gcp, linux-image-lowlatency-hwe-16.04, linux-kvm, linux-image-raspi2, linux-image-azure-lts-18.04, linux-image-generic-hwe-16.04-edge, linux-image-4.15.0-118-lowlatency, linux-image-kvm, linux-aws-hwe, linux-image-virtual-hwe-16.04-edge, linux-image-aws-lts-18.04, linux-image-4.15.0-1087-snapdragon, linux-image-generic-lpae-hwe-16.04, linux-snapdragon, linux-raspi2, linux-image-4.15.0-1070-gke, linux-image-generic-lpae, linux-image-gcp, linux-gcp-4.15, linux, linux-aws, linux-image-virtual-hwe-16.04, linux-image-gke-4.15, linux-image-generic, linux-image-4.15.0-1054-oracle, linux-azure, linux-image-oracle, linux-azure-4.15, linux-image-4.15.0-1097-oem, linux-oracle
• USN-4527-1: linux-image-powerpc64-emb-lts-xenial, linux-image-generic-lpae-lts-wily, linux-image-generic-lts-vivid, linux-image-powerpc64-smp-lts-utopic, linux-image-powerpc64-smp, linux-image-virtual-lts-vivid, linux-image-powerpc64-smp-lts-xenial, linux-image-lowlatency, linux-lts-xenial, linux-image-powerpc-smp, linux-image-generic-lts-xenial, linux-image-powerpc64-emb-lts-wily, linux-image-snapdragon, linux-image-generic-lts-wily, linux-image-generic-lpae-lts-vivid, linux-image-powerpc-smp-lts-wily, linux-image-virtual, linux-image-powerpc-smp-lts-xenial, linux-kvm, linux-image-generic-lpae-lts-xenial, linux-image-powerpc64-emb-lts-utopic, linux-image-raspi2, linux-image-generic-lpae-lts-utopic, linux-image-virtual-lts-xenial, linux-image-kvm, linux-image-virtual-lts-utopic, linux-image-4.4.0-1139-raspi2, linux-image-aws, linux-image-powerpc-e500mc-lts-wily, linux-image-4.4.0-190-powerpc-e500mc, linux-image-lowlatency-lts-wily, linux-image-lowlatency-lts-xenial, linux-image-4.4.0-190-generic-lpae, linux-image-powerpc-e500mc-lts-xenial, linux-image-powerpc-smp-lts-vivid, linux-image-virtual-lts-wily, linux-image-powerpc64-smp-lts-vivid, linux-image-generic-lts-utopic, linux-image-4.4.0-1114-aws, linux-image-powerpc64-smp-lts-wily, linux-image-lowlatency-lts-vivid, linux-image-powerpc-e500mc-lts-vivid, linux-image-4.4.0-1078-aws, linux-image-4.4.0-190-powerpc-smp, linux-image-4.4.0-190-powerpc64-emb, linux-image-4.4.0-190-lowlatency, linux-image-powerpc-e500mc, linux-image-powerpc64-emb-lts-vivid, linux-raspi2, linux-image-generic-lpae, linux-snapdragon, linux-image-powerpc-e500mc-lts-utopic, linux-image-powerpc64-emb, linux, linux-aws, linux-image-4.4.0-1143-snapdragon, linux-image-4.4.0-190-powerpc64-smp, linux-image-generic, linux-image-powerpc-smp-lts-utopic, linux-image-4.4.0-1080-kvm, linux-image-lowlatency-lts-utopic, linux-image-4.4.0-190-generic
• USN-5361-1: linux-image-generic-lts-vivid, linux-tools-host, linux-tools-virtual-lts-utopic, linux-tools-lts-utopic, linux-doc, linux-headers-virtual-lts-xenial, linux-tools-virtual-lts-vivid, linux-tools-4.4.0-223, linux-tools-aws, linux-hwe-generic-trusty, linux-lowlatency, linux-image-generic-lts-wily, linux-signed-image-lowlatency-lts-wily, linux-tools-lowlatency-lts-xenial, linux-tools-4.4.0-223-lowlatency, linux-signed-generic, linux-generic, linux-source-4.4.0, linux-modules-4.4.0-1103-aws, linux-signed-lowlatency-lts-wily, linux-image-virtual-lts-utopic, linux-signed-generic-lts-xenial, linux-image-virtual-lts-wily, linux-image-lowlatency-lts-vivid, linux-lts-xenial-tools-4.4.0-223, linux-modules-4.4.0-1104-kvm, linux-cloud-tools-generic-lts-vivid, linux-image-unsigned-4.4.0-223-lowlatency, linux-lowlatency-lts-vivid, linux-tools-kvm, linux, linux-image-4.4.0-1103-aws, linux-virtual-lts-wily, linux-cloud-tools-4.4.0-1103-aws, linux-cloud-tools-4.4.0-223-lowlatency, linux-crashdump, linux-kvm-headers-4.4.0-1104, linux-lts-xenial-cloud-tools-4.4.0-223, linux-signed-image-lowlatency, linux-headers-4.4.0-223-lowlatency, linux-kvm-tools-4.4.0-1104, linux-tools-virtual-lts-xenial, linux-headers-generic-lts-xenial, linux-buildinfo-4.4.0-223-generic, linux-buildinfo-4.4.0-1103-aws, linux-libc-dev, linux-cloud-tools-virtual, linux-generic-lts-utopic, linux-image-unsigned-4.4.0-223-generic, linux-image-lowlatency, linux-cloud-tools-virtual-lts-xenial, linux-cloud-tools-4.4.0-1104-kvm, linux-virtual, linux-modules-4.4.0-223-lowlatency, linux-image-extra-virtual, linux-signed-image-generic-lts-utopic, linux-tools-generic-lts-vivid, linux-tools-lowlatency-lts-wily, linux-aws-tools-4.4.0-1103, linux-aws-cloud-tools-4.4.0-1139, linux-cloud-tools-4.4.0-1139-aws, linux-signed-lowlatency-lts-xenial, linux-image-extra-virtual-lts-vivid, linux-signed-lowlatency, linux-kvm, linux-headers-virtual-lts-utopic, linux-signed-image-generic-lts-wily, linux-virtual-lts-vivid, linux-image-generic-lts-utopic, linux-headers-generic-lts-wily, linux-image-4.4.0-1139-aws, linux-aws-headers-4.4.0-1139, linux-modules-extra-aws, linux-aws-tools-4.4.0-1139, linux-image-hwe-generic-trusty, linux-headers-4.4.0-223-generic, linux-image-generic, linux-virtual-lts-xenial, linux-headers-aws, linux-headers-lowlatency-lts-xenial, linux-tools-4.4.0-1139-aws, linux-cloud-tools-common, linux-tools-lowlatency-lts-vivid, linux-modules-4.4.0-223-generic, linux-image-virtual-lts-vivid, linux-tools-4.4.0-1104-kvm, linux-image-4.4.0-223-generic, linux-signed-generic-lts-vivid, linux-buildinfo-4.4.0-1104-kvm, linux-tools-generic-lts-xenial, linux-headers-4.4.0-1104-kvm, linux-headers-lowlatency-lts-vivid, linux-headers-4.4.0-1103-aws, linux-headers-lowlatency, linux-signed-generic-lts-utopic, linux-generic-lts-xenial, linux-headers-4.4.0-223, linux-image-virtual, linux-cloud-tools-4.4.0-223, linux-cloud-tools-lowlatency-lts-vivid, linux-headers-generic, linux-cloud-tools-4.4.0-223-generic, linux-cloud-tools-virtual-lts-vivid, linux-headers-lowlatency-lts-wily, linux-buildinfo-4.4.0-1139-aws, linux-image-hwe-virtual-trusty, linux-image-kvm, linux-modules-4.4.0-1139-aws, linux-image-lowlatency-lts-xenial, linux-tools-common, linux-headers-4.4.0-1139-aws, linux-modules-extra-4.4.0-1139-aws, linux-signed-image-lowlatency-lts-xenial, linux-buildinfo-4.4.0-223-lowlatency, linux-signed-image-generic-lts-vivid, linux-image-4.4.0-223-lowlatency, linux-aws, linux-cloud-tools-generic-lts-xenial, linux-signed-image-generic-lts-xenial, linux-tools-lowlatency, linux-image-lowlatency-lts-utopic, linux-generic-lts-wily, linux-hwe-virtual-trusty, linux-cloud-tools-virtual-lts-utopic, linux-tools-4.4.0-1103-aws, linux-tools-4.4.0-223-generic, linux-tools-lowlatency-lts-utopic, linux-cloud-tools-generic, linux-lts-xenial, linux-generic-lts-vivid, linux-aws-headers-4.4.0-1103, linux-image-generic-lts-xenial, linux-source, linux-tools-generic, linux-cloud-tools-lowlatency-lts-xenial, linux-cloud-tools-lowlatency, linux-tools-generic-lts-utopic, linux-image-extra-virtual-lts-wily, linux-image-extra-virtual-lts-xenial, linux-tools-generic-lts-wily, linux-modules-extra-4.4.0-223-generic, linux-headers-generic-lts-vivid, linux-image-4.4.0-1104-kvm, linux-headers-lowlatency-lts-utopic, linux-cloud-tools-lowlatency-lts-utopic, linux-cloud-tools-generic-lts-wily, linux-lowlatency-lts-utopic, linux-image-virtual-lts-xenial, linux-headers-virtual, linux-cloud-tools-generic-lts-utopic, linux-virtual-lts-utopic, linux-image-aws, linux-headers-kvm, linux-signed-image-generic, linux-signed-generic-lts-wily, linux-image-extra-virtual-lts-utopic, linux-aws-cloud-tools-4.4.0-1103, linux-headers-generic-lts-utopic, linux-tools-virtual, linux-lowlatency-lts-xenial, linux-lowlatency-lts-wily, linux-tools-virtual-lts-wily, linux-headers-virtual-lts-wily, linux-headers-virtual-lts-vivid, linux-kvm-cloud-tools-4.4.0-1104, linux-cloud-tools-lowlatency-lts-wily, linux-cloud-tools-virtual-lts-wily, linux-image-lowlatency-lts-wily
• USN-4578-1: linux-image-4.15.0-1098-azure, linux-image-gke, linux-hwe, linux-image-4.15.0-1056-oracle, linux-image-generic-lpae-hwe-16.04-edge, linux-image-lowlatency-hwe-16.04-edge, linux-image-oem, linux-image-lowlatency, linux-image-azure, linux-image-4.15.0-1099-azure, linux-image-4.15.0-1085-aws, linux-image-4.15.0-121-generic-lpae, linux-image-oracle-lts-18.04, linux-image-aws-hwe, linux-image-4.15.0-1072-gke, linux-image-azure-edge, linux-image-generic-hwe-16.04, linux-image-snapdragon, linux-image-gcp-lts-18.04, linux-image-4.15.0-1086-gcp, linux-oem, linux-gcp, linux-image-virtual, linux-gke-4.15, linux-image-lowlatency-hwe-16.04, linux-image-4.15.0-1089-snapdragon, linux-image-raspi2, linux-kvm, linux-image-azure-lts-18.04, linux-image-generic-hwe-16.04-edge, linux-image-kvm, linux-aws-hwe, linux-image-virtual-hwe-16.04-edge, linux-image-4.15.0-1057-oracle, linux-image-aws-lts-18.04, linux-image-4.15.0-1086-aws, linux-oracle, linux-image-4.15.0-120-lowlatency, linux-image-generic-lpae-hwe-16.04, linux-snapdragon, linux-raspi2, linux-image-4.15.0-120-generic-lpae, linux-image-generic-lpae, linux-image-gcp, linux-gcp-4.15, linux, linux-aws, linux-image-virtual-hwe-16.04, linux-image-gke-4.15, linux-image-generic, linux-image-4.15.0-1099-oem, linux-image-4.15.0-120-generic, linux-azure, linux-image-4.15.0-1073-raspi2, linux-image-4.15.0-121-generic, linux-azure-4.15, linux-image-oracle, linux-image-4.15.0-121-lowlatency, linux-image-4.15.0-1077-kvm
• USN-4752-1: linux-oem-5.6, linux-image-5.6.0-1048-oem, linux-image-oem-20.04