| Beschreibung: | Summary:
The remote host is missing an update for the 'linux-azure'
package(s) announced via the referenced advisory.
Vulnerability Insight:
USN-3581-1 fixed vulnerabilities in the
Linux kernel for Ubuntu 17.10. This update provides the corresponding updates
for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu
16.04 LTS. Mohamed Ghannam discovered that the IPv4 raw socket implementation in
the Linux kernel contained a race condition leading to uninitialized pointer
usage. A local attacker could use this to cause a denial of service or possibly
execute arbitrary code. (CVE-2017-17712) ChunYu Wang discovered that a
use-after-free vulnerability existed in the SCTP protocol implementation in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code, (CVE-2017-15115) Mohamed
Ghannam discovered a use-after-free vulnerability in the DCCP protocol
implementation in the Linux kernel. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-8824) USN-3541-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the
amd64 architecture in Ubuntu 16.04 LTS. This update provides the compiler-based
retpoline kernel mitigation for the amd64 and i386 architectures. Original
advisory details: Jann Horn discovered that microprocessors utilizing
speculative execution and branch prediction may allow unauthorized memory reads
via sidechannel attacks. This flaw is known as Spectre. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5715)
Affected Software/OS:
linux-azure on Ubuntu 16.04 LTS
Solution:
Please Install the Updated Packages.
CVSS Score:
7.2
CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
