Test ID:	1.3.6.1.4.1.25623.1.1.12.2019.3878.3
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3878-3)
Summary:	The remote host is missing an update for the 'linux, linux-hwe' package(s) announced via the USN-3878-3 advisory.
Description:	Summary: The remote host is missing an update for the 'linux, linux-hwe' package(s) announced via the USN-3878-3 advisory. Vulnerability Insight: USN-3878-1 fixed vulnerabilities in the Linux kernel. Unfortunately, that update introduced a regression that could prevent systems with certain graphics chipsets from booting. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that a race condition existed in the vsock address family implementation of the Linux kernel that could lead to a use-after-free condition. A local attacker in a guest virtual machine could use this to expose sensitive information (host machine kernel memory). (CVE-2018-14625) Cfir Cohen discovered that a use-after-free vulnerability existed in the KVM implementation of the Linux kernel, when handling interrupts in environments where nested virtualization is in use (nested KVM virtualization is not enabled by default in Ubuntu kernels). A local attacker in a guest VM could possibly use this to gain administrative privileges in a host machine. (CVE-2018-16882) Wei Wu discovered that the KVM implementation in the Linux kernel did not properly ensure that ioapics were initialized. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-19407) It was discovered that the crypto subsystem of the Linux kernel leaked uninitialized memory to user space in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-19854) Affected Software/OS: 'linux, linux-hwe' package(s) on Ubuntu 18.04, Ubuntu 18.10. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-14625 RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2029 RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2019:2043 RHSA-2019:4154 https://access.redhat.com/errata/RHSA-2019:4154 USN-3871-1 https://usn.ubuntu.com/3871-1/ USN-3871-3 https://usn.ubuntu.com/3871-3/ USN-3871-4 https://usn.ubuntu.com/3871-4/ USN-3871-5 https://usn.ubuntu.com/3871-5/ USN-3872-1 https://usn.ubuntu.com/3872-1/ USN-3878-1 https://usn.ubuntu.com/3878-1/ USN-3878-2 https://usn.ubuntu.com/3878-2/ [debian-lts-announce] 20190503 [SECURITY] [DLA 1771-1] linux-4.9 security update https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14625 https://syzkaller.appspot.com/bug?extid=bd391451452fb0b93039 Common Vulnerability Exposure (CVE) ID: CVE-2018-16882 106254 http://www.securityfocus.com/bid/106254 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16882 https://lwn.net/Articles/775720/ https://lwn.net/Articles/775721/ https://marc.info/?l=kvm&m=154514994222809&w=2 https://support.f5.com/csp/article/K80557033 Common Vulnerability Exposure (CVE) ID: CVE-2018-19407 BugTraq ID: 105987 http://www.securityfocus.com/bid/105987 https://lkml.org/lkml/2018/11/20/580 https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html https://usn.ubuntu.com/3879-1/ https://usn.ubuntu.com/3879-2/ Common Vulnerability Exposure (CVE) ID: CVE-2018-19854 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f43f39958beb206b53292801e216d9b8a660f087 https://github.com/torvalds/linux/commit/f43f39958beb206b53292801e216d9b8a660f087 https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.3 RedHat Security Advisories: RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3309 RedHat Security Advisories: RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3517 https://usn.ubuntu.com/3901-1/ https://usn.ubuntu.com/3901-2/
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.