Kernel Live Patch Security Notice LSN-0022-1

======================================== ==========================================================================
Kernel Live Patch Security Notice LSN-0022-1
May 16, 2017

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series | Base kernel | Arch | flavors |
|------------------+--------------+----------+------------------|
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

It was discovered that a use-after-free flaw existed in the filesystem
encryption subsystem in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-7374)

Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel | Version | flavors |
|-----------------+----------+--------------------------|
| 4.4.0-21.37 | 22.5 | generic, lowlatency |
| 4.4.0-22.39 | 22.4 | generic, lowlatency |
| 4.4.0-22.40 | 22.4 | generic, lowlatency |
| 4.4.0-24.43 | 22.4 | generic, lowlatency |
| 4.4.0-28.47 | 22.4 | generic, lowlatency |
| 4.4.0-31.50 | 22.4 | generic, lowlatency |
| 4.4.0-34.53 | 22.4 | generic, lowlatency |
| 4.4.0-36.55 | 22.4 | generic, lowlatency |
| 4.4.0-38.57 | 22.4 | generic, lowlatency |
| 4.4.0-42.62 | 22.4 | generic, lowlatency |
| 4.4.0-43.63 | 22.4 | generic, lowlatency |
| 4.4.0-45.66 | 22.4 | generic, lowlatency |
| 4.4.0-47.68 | 22.4 | generic, lowlatency |
| 4.4.0-51.72 | 22.4 | generic, lowlatency |
| 4.4.0-53.74 | 22.4 | generic, lowlatency |
| 4.4.0-57.78 | 22.4 | generic, lowlatency |
| 4.4.0-59.80 | 22.4 | generic, lowlatency |
| 4.4.0-62.83 | 22.4 | generic, lowlatency |
| 4.4.0-63.84 | 22.4 | generic, lowlatency |
| 4.4.0-64.85 | 22.4 | generic, lowlatency |
| 4.4.0-66.87 | 22.4 | generic, lowlatency |
| 4.4.0-67.88 | 22.4 | generic, lowlatency |
| 4.4.0-70.91 | 22.4 | generic, lowlatency |
| 4.4.0-71.92 | 22.4 | generic, lowlatency |
| 4.4.0-71.92 | 22.4 | generic, lowlatency |
| 4.4.0-72.93 | 22.4 | generic, lowlatency |

Additionally, you should install an updated kernel with these fixes and
reboot at your convienience.

References:
CVE-2016-7097, CVE-2017-7374

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce