linux-lts-xenial, linux-aws vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

* Ubuntu 14.04 ESM

Summary

Several security issues were fixed in the Linux kernel.

Software Description

* linux-aws - Linux kernel for Amazon Web Services (AWS) systems
* linux-lts-xenial - Linux hardware enablement kernel from
Xenial for Trusty

Details

USN-4286-1 fixed vulnerabilities in the Linux kernel for Ubuntu
16.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for
Ubuntu 14.04 ESM.

It was discovered that the Linux kernel did not properly clear
data structures on context switches for certain Intel graphics
processors. A local attacker could use this to expose sensitive
information. (CVE-2019-14615)

It was discovered that a race condition existed in the Softmac USB
Prism54 device driver in the Linux kernel. A physically proximate
attacker could use this to cause a denial of service (system
crash). (CVE-2019-15220)

Julien Grall discovered that the Xen balloon memory driver in the
Linux kernel did not properly restrict the amount of memory set
aside for page mappings in some situations. An attacker could use
this to cause a denial of service (kernel memory exhaustion).
(CVE-2019-17351)

It was discovered that the Intel WiMAX 2400 driver in the Linux
kernel did not properly deallocate memory in certain situations. A
local attacker could use this to cause a denial of service (kernel
memory exhaustion). (CVE-2019-19051)

It was discovered that the Marvell Wi-Fi device driver in the
Linux kernel did not properly deallocate memory in certain error
conditions. A local attacker could use this to possibly cause a
denial of service (kernel memory exhaustion). (CVE-2019-19056)

It was discovered that the Brocade BFA Fibre Channel device driver
in the Linux kernel did not properly deallocate memory in certain
error conditions. A local attacker could possibly use this to
cause a denial of service (kernel memory exhaustion).
(CVE-2019-19066)

It was discovered that the Realtek RTL8xxx USB Wi-Fi device driver
in the Linux kernel did not properly deallocate memory in certain
error conditions. A local attacker could possibly use this to
cause a denial of service (kernel memory exhaustion).
(CVE-2019-19068)

Gao Chuan discovered that the SAS Class driver in the Linux kernel
contained a race condition that could lead to a NULL pointer
dereference. A local attacker could possibly use this to cause a
denial of service (system crash). (CVE-2019-19965)

It was discovered that the Datagram Congestion Control Protocol
(DCCP) implementation in the Linux kernel did not properly
deallocate memory in certain error conditions. An attacker could
possibly use this to cause a denial of service (kernel memory
exhaustion). (CVE-2019-20096)

Mitchell Frank discovered that the Wi-Fi implementation in the
Linux kernel when used as an access point would send IAPP location
updates for stations before client authentication had completed. A
physically proximate attacker could use this to cause a denial of
service. (CVE-2019-5108)

It was discovered that ZR364XX Camera USB device driver for the
Linux kernel did not properly initialize memory. A physically
proximate attacker could use this to cause a denial of service
(system crash). (CVE-2019-15217)

It was discovered that the Line 6 POD USB device driver in the
Linux kernel did not properly validate data size information from
the device. A physically proximate attacker could use this to
cause a denial of service (system crash). (CVE-2019-15221)

Update instructions

The problem can be corrected by updating your system to the
following package versions:

Ubuntu 14.04 ESM
linux-image-4.4.0-1062-aws - 4.4.0-1062.66
linux-image-4.4.0-174-generic - 4.4.0-174.204~14.04.1
linux-image-4.4.0-174-generic-lpae - 4.4.0-174.204~14.04.1
linux-image-4.4.0-174-lowlatency - 4.4.0-174.204~14.04.1
linux-image-4.4.0-174-powerpc-e500mc -
4.4.0-174.204~14.04.1
linux-image-4.4.0-174-powerpc-smp - 4.4.0-174.204~14.04.1
linux-image-4.4.0-174-powerpc64-emb -
4.4.0-174.204~14.04.1
linux-image-4.4.0-174-powerpc64-smp -
4.4.0-174.204~14.04.1
linux-image-aws - 4.4.0.1062.63
linux-image-generic-lpae-lts-xenial - 4.4.0.174.153
linux-image-generic-lts-xenial - 4.4.0.174.153
linux-image-lowlatency-lts-xenial - 4.4.0.174.153
linux-image-powerpc-e500mc-lts-xenial - 4.4.0.174.153
linux-image-powerpc-smp-lts-xenial - 4.4.0.174.153
linux-image-powerpc64-emb-lts-xenial - 4.4.0.174.153
linux-image-powerpc64-smp-lts-xenial - 4.4.0.174.153
linux-image-virtual-lts-xenial - 4.4.0.174.153

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to
make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates
have been given a new version number, which requires you to
recompile and reinstall all third party kernel modules you might
have installed. Unless you manually uninstalled the standard
kernel metapackages (e.g. linux-generic,
linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a
standard system upgrade will automatically perform this as well.

References

* USN-4286-1
* CVE-2019-14615
* CVE-2019-15217
* CVE-2019-15220
* CVE-2019-15221
* CVE-2019-17351
* CVE-2019-19051
* CVE-2019-19056
* CVE-2019-19066
* CVE-2019-19068
* CVE-2019-19965
* CVE-2019-20096
* CVE-2019-5108

--- Mystic BBS v1.12 A44 (Linux/64)
* Origin: BZ&BZ BBS (21:4/110)