-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEET5B4c0UgisHPJeML4cb9mBt1GIMFAl/JQ3EACgkQ4cb9mBt1
GIPKwg//fjlprtZB3riyt0P9ucwgNCTmFvzCmI3mzwapHj/XImASYg4/Vnu/m3ch
Tkm+c0v1mrGiAFGoVpJepulmhARKx2b19IPowvdMM6pjppr/TVwHW0H8hv2dPiUT
Sbnhen/16Uz8Sonwp/pqvj/vd723GGq6SILUTRyQYidoiTABrVFMTe5jq9Gg66FW
BWXzJMxuZR2ZKJr+dtsnwSoJruaged9q6qX+tPEqVKQ1N+cTwblnbhD1qbsK+A8u
vpBaD6QF8zFDDC71PEnx1zTQlKYAPp2yiznoZKsIExIlB7LP7m3C4NkDXbO+vzJl
Fdwk7463TYw3O6sHJ6fWB60iSqoUdmqRthCVypQznGzYSNinax54UG2x6w3F5ca8
imUdLNKp0FdVFzM57AsXVnmkZ0x7kMYWZPz29HUicM2PHalFWreW6GedEsczIyTz
p6gJxfLcKWMc1jY6CGLTn7mps27MSJzPYNFWl97GQ7ZYmUj+h3robjeEgBPbOqvB
LrysgmBJECW8Ee0jsdfKFRe/qfJjDYsOP66rRRh3MDQ1Gs/LNH5j6QubX9zeFOMi
as5vfvdqrwV+/rFg/hQogaNNmjz/+WyK78NriOQfGQeRn/U5K/kpSZabNWqunj1W
UVp80B0Ih+igdWjYDAAqMBwPn+vyCjHhVD10L7vQILjKDManbQk=
=ZvN0
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4661-1
December 03, 2020
snapcraft vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
An intended access restriction could be bypassed in snaps built with
Snapcraft
Software Description:
- snapcraft: easily craft snaps
Details:
It was discovered that Snapcraft includes the current directory when
configuring LD_LIBRARY_PATH for application commands. If a user were
tricked into installing a malicious snap or downloading a malicious
library, under certain circumstances an attacker could exploit this to
affect strict mode snaps that have access to the library and when
launched from the directory containing the library.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
snapcraft 2.43.1+18.04.1
Ubuntu 16.04 LTS:
snapcraft 2.43.1+16.04.1
For users of the snap package, Snapcraft will automatically refresh
itself to Snapcraft 4.4.4 which is unaffected. For users of the deb
package, on Ubuntu 16.04 LTS and 18.04 LTS, please perform a standard
system update. In either case, once Snapcraft has been updated, you need
to rebuild any packages built with the affected Snapcraft.
References:
https://usn.ubuntu.com/4661-1
CVE-2020-27348, https://launchpad.net/bugs/1901572
Package Information:
https://launchpad.net/ubuntu/+source/snapcraft/2.43.1+18.04.1
https://launchpad.net/ubuntu/+source/snapcraft/2.43.1+16.04.1
Thursday, December 3, 2020
Fedora 34 Change: GitRepos-master-to-main (Self-Contained Change)
https://fedoraproject.org/wiki/Changes/GitRepos-master-to-main
== Summary ==
This Change will move Fedora git repositories to use "main" as the
default git branch instead of "master". Specific repositories will be
manually moved and default git branch for new projects will be set to
use "main".
The Fedora Community strives to be open and welcoming. Some language
around our git repositories is dated and could be more inclusive. Many
git repositories currently use "master" as the default branch. This
Change will move many repositories (see below) to use a "main" branch
as default. This small bit of naming adjustment is in-line with
Fedora's vision for free and open source software built by inclusive,
welcoming, and open-minded communities.
== Owner ==
* Name: [[User:Kevin| Kevin Fenzi]], [[User:bcotton| Ben Cotton]],
[[User:pingou| pingou]], [[User:mohanboddu| Mohan Boddu]],
[[User:till| Till Maas]]
* Email: kevin@scrye.com, bcotton@redhat.com, pingou@pingoured.fr,
mboddu@bhujji.com, opensource@till.name
== Detailed Description ==
The Fedora Project controls a number of git repositories. This change
will move the default branch (that is, the git branch used when
nothing is specified) from 'master' to 'main'. Existing git clones
will need to pull to get the changed default branch. Existing Pull
Requests against the 'master' branch will need to be rebased against
the 'main' branch. Documentation will be updated.
== Benefit to Fedora ==
The Fedora Project will be a more welcoming place for new contributors.
== Scope ==
This change will take place in a number of phases:
=== Phase0 - 2020-12-14 ===
A guide will be published to explain how maintainers/project
managers can change the default
branch on pagure.io, which they can then do based in their projects desires.
=== Phase1 - 2020-12-15 ===
The following repos will be switched:
src.fedoraproject.org/flatpacks/*
pagure.io:
releng
releng/*
fedora-comps
fedora-kickstarts
fedora-infrastructure
fedora-lorax-templates
fedora-mediawikitheme
fedora-packager
fedora-infra/*
infra-docs
koji-fedmsg-plugin
workstation-ostree-config
pungi-fedora
github.com
fedora-infra/*
=== Phase2 - 2021-01-13 ===
src.fedoraproject.org/*
pagure.io default for new projects will be changed to 'main'
* Proposal owners:
Switching all above listed projects git repos to use 'main'
Deleting the 'master' branch
Announcing when changes have been made on devel-announce / other lists.
* Other developers:
Other developers are encouraged to change their upstream projects
on pagure.io, github or gitlab.
* Release engineering:
Releng will adjust any scripts that assume 'master' branch to use
'main' instead. The list includes and maybe few more
[https://pagure.io/releng/blob/master/f/scripts/update-critpath.py
update-critpath.py]
[https://pagure.io/releng/blob/master/f/scripts/block_retired.py
block_retired.py]
[https://pagure.io/releng/blob/master/f/scripts/update-docs.sh
update-docs.sh]
[https://pagure.io/releng/blob/master/f/scripts/find_unblocked_orphans.py
find_unblocked_orphans.py]
[https://pagure.io/releng/blob/master/f/scripts/mass-rebuild-second-run.py
mass-rebuild-second-run.py]
[https://pagure.io/releng/blob/master/f/scripts/adjust-eol-modules.py
adjust-eol-modules.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol-modules.py
adjust-eol-modules.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol-modules.py
adjust-eol-modules.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol.py
adjust-eol.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/create-new-release-branches.py
create-new-release-branches.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/create-branch.py
create-branch.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol-all.py
adjust-eol-all.py]
[https://pagure.io/releng/blob/master/f/scripts/check-unretirement.py
check-unretirement.py]
[https://pagure.io/releng/blob/master/f/scripts/mass-rebuild-special.py
mass-rebuild-special.py]
[https://pagure.io/releng/blob/master/f/scripts/need-rebuild.py
need-rebuild.py]
[https://pagure.io/releng/blob/master/f/scripts/distgit-branch-unused.py
distgit-branch-unused.py]
[https://pagure.io/releng/blob/master/f/scripts/create-new-release-branches.py
create-new-release-branches.py]
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with Objectives:
== Upgrade/compatibility impact ==
Users with old checkouts will need to update their git configuration
or re-clone repositories that have changed before they can see any new
changes.
Repos used to build content for docs.fedoraproject.org can change the
default git branch, but the Antora module version (in `antora.yml`)
should remain `master` pending support for alternate "unversioned"
versions upstream.
== How To Test ==
# git clone <one of the listed repositories>
# cd <repositoryname>
# git branch
should return: `* main`
== User Experience ==
Users and developers will see more welcoming language and that the
fedora project expended effort to be more welcoming to them.
== Dependencies ==
none
== Contingency Plan ==
* Contingency mechanism: Revert repositories, scripts, and docs back
to the unwelcoming 'master'
* Contingency date: 2020-01-13
== Documentation ==
A short guide on how to change this for pagure.io will be produced.
== Release Notes ==
Many git repositories used to create Fedora releases were moved to use
a 'main' branch instead of a 'master' branch. The Fedora Project
envisions a world where everyone benefits from free and open source
software built by inclusive, welcoming, and open-minded communities.
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
This Change will move Fedora git repositories to use "main" as the
default git branch instead of "master". Specific repositories will be
manually moved and default git branch for new projects will be set to
use "main".
The Fedora Community strives to be open and welcoming. Some language
around our git repositories is dated and could be more inclusive. Many
git repositories currently use "master" as the default branch. This
Change will move many repositories (see below) to use a "main" branch
as default. This small bit of naming adjustment is in-line with
Fedora's vision for free and open source software built by inclusive,
welcoming, and open-minded communities.
== Owner ==
* Name: [[User:Kevin| Kevin Fenzi]], [[User:bcotton| Ben Cotton]],
[[User:pingou| pingou]], [[User:mohanboddu| Mohan Boddu]],
[[User:till| Till Maas]]
* Email: kevin@scrye.com, bcotton@redhat.com, pingou@pingoured.fr,
mboddu@bhujji.com, opensource@till.name
== Detailed Description ==
The Fedora Project controls a number of git repositories. This change
will move the default branch (that is, the git branch used when
nothing is specified) from 'master' to 'main'. Existing git clones
will need to pull to get the changed default branch. Existing Pull
Requests against the 'master' branch will need to be rebased against
the 'main' branch. Documentation will be updated.
== Benefit to Fedora ==
The Fedora Project will be a more welcoming place for new contributors.
== Scope ==
This change will take place in a number of phases:
=== Phase0 - 2020-12-14 ===
A guide will be published to explain how maintainers/project
managers can change the default
branch on pagure.io, which they can then do based in their projects desires.
=== Phase1 - 2020-12-15 ===
The following repos will be switched:
src.fedoraproject.org/flatpacks/*
pagure.io:
releng
releng/*
fedora-comps
fedora-kickstarts
fedora-infrastructure
fedora-lorax-templates
fedora-mediawikitheme
fedora-packager
fedora-infra/*
infra-docs
koji-fedmsg-plugin
workstation-ostree-config
pungi-fedora
github.com
fedora-infra/*
=== Phase2 - 2021-01-13 ===
src.fedoraproject.org/*
pagure.io default for new projects will be changed to 'main'
* Proposal owners:
Switching all above listed projects git repos to use 'main'
Deleting the 'master' branch
Announcing when changes have been made on devel-announce / other lists.
* Other developers:
Other developers are encouraged to change their upstream projects
on pagure.io, github or gitlab.
* Release engineering:
Releng will adjust any scripts that assume 'master' branch to use
'main' instead. The list includes and maybe few more
[https://pagure.io/releng/blob/master/f/scripts/update-critpath.py
update-critpath.py]
[https://pagure.io/releng/blob/master/f/scripts/block_retired.py
block_retired.py]
[https://pagure.io/releng/blob/master/f/scripts/update-docs.sh
update-docs.sh]
[https://pagure.io/releng/blob/master/f/scripts/find_unblocked_orphans.py
find_unblocked_orphans.py]
[https://pagure.io/releng/blob/master/f/scripts/mass-rebuild-second-run.py
mass-rebuild-second-run.py]
[https://pagure.io/releng/blob/master/f/scripts/adjust-eol-modules.py
adjust-eol-modules.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol-modules.py
adjust-eol-modules.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol-modules.py
adjust-eol-modules.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol.py
adjust-eol.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/create-new-release-branches.py
create-new-release-branches.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/create-branch.py
create-branch.py]
[https://pagure.io/releng/blob/master/f/scripts/pdc/adjust-eol-all.py
adjust-eol-all.py]
[https://pagure.io/releng/blob/master/f/scripts/check-unretirement.py
check-unretirement.py]
[https://pagure.io/releng/blob/master/f/scripts/mass-rebuild-special.py
mass-rebuild-special.py]
[https://pagure.io/releng/blob/master/f/scripts/need-rebuild.py
need-rebuild.py]
[https://pagure.io/releng/blob/master/f/scripts/distgit-branch-unused.py
distgit-branch-unused.py]
[https://pagure.io/releng/blob/master/f/scripts/create-new-release-branches.py
create-new-release-branches.py]
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with Objectives:
== Upgrade/compatibility impact ==
Users with old checkouts will need to update their git configuration
or re-clone repositories that have changed before they can see any new
changes.
Repos used to build content for docs.fedoraproject.org can change the
default git branch, but the Antora module version (in `antora.yml`)
should remain `master` pending support for alternate "unversioned"
versions upstream.
== How To Test ==
# git clone <one of the listed repositories>
# cd <repositoryname>
# git branch
should return: `* main`
== User Experience ==
Users and developers will see more welcoming language and that the
fedora project expended effort to be more welcoming to them.
== Dependencies ==
none
== Contingency Plan ==
* Contingency mechanism: Revert repositories, scripts, and docs back
to the unwelcoming 'master'
* Contingency date: 2020-01-13
== Documentation ==
A short guide on how to change this for pagure.io will be produced.
== Release Notes ==
Many git repositories used to create Fedora releases were moved to use
a 'main' branch instead of a 'master' branch. The Fedora Project
envisions a world where everyone benefits from free and open source
software built by inclusive, welcoming, and open-minded communities.
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Wednesday, December 2, 2020
[USN-4660-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4660-1
December 03, 2020
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem,
linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-4.15: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oem: Linux kernel for OEM systems
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2020-25211)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)
It was discovered that the block layer subsystem in the Linux kernel did
not properly handle zero-length requests. A local attacker could use this
to cause a denial of service. (CVE-2020-25641)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1059-oracle 4.15.0-1059.65
linux-image-4.15.0-1074-gke 4.15.0-1074.79
linux-image-4.15.0-1074-raspi2 4.15.0-1074.79
linux-image-4.15.0-1079-kvm 4.15.0-1079.81
linux-image-4.15.0-1088-aws 4.15.0-1088.93
linux-image-4.15.0-1088-gcp 4.15.0-1088.101
linux-image-4.15.0-1091-snapdragon 4.15.0-1091.100
linux-image-4.15.0-1100-azure 4.15.0-1100.111
linux-image-4.15.0-1103-oem 4.15.0-1103.114
linux-image-4.15.0-126-generic 4.15.0-126.129
linux-image-4.15.0-126-generic-lpae 4.15.0-126.129
linux-image-4.15.0-126-lowlatency 4.15.0-126.129
linux-image-aws-lts-18.04 4.15.0.1088.90
linux-image-azure-lts-18.04 4.15.0.1100.73
linux-image-gcp-lts-18.04 4.15.0.1088.106
linux-image-generic 4.15.0.126.113
linux-image-generic-lpae 4.15.0.126.113
linux-image-gke 4.15.0.1074.78
linux-image-gke-4.15 4.15.0.1074.78
linux-image-kvm 4.15.0.1079.75
linux-image-lowlatency 4.15.0.126.113
linux-image-oem 4.15.0.1103.107
linux-image-oracle-lts-18.04 4.15.0.1059.69
linux-image-powerpc-e500mc 4.15.0.126.113
linux-image-powerpc-smp 4.15.0.126.113
linux-image-powerpc64-emb 4.15.0.126.113
linux-image-powerpc64-smp 4.15.0.126.113
linux-image-raspi2 4.15.0.1074.71
linux-image-snapdragon 4.15.0.1091.94
linux-image-virtual 4.15.0.126.113
Ubuntu 16.04 LTS:
linux-image-4.15.0-1059-oracle 4.15.0-1059.65~16.04.1
linux-image-4.15.0-1088-aws 4.15.0-1088.93~16.04.1
linux-image-4.15.0-1088-gcp 4.15.0-1088.101~16.04.1
linux-image-4.15.0-1100-azure 4.15.0-1100.111~16.04.1
linux-image-4.15.0-126-generic 4.15.0-126.129~16.04.1
linux-image-4.15.0-126-generic-lpae 4.15.0-126.129~16.04.1
linux-image-4.15.0-126-lowlatency 4.15.0-126.129~16.04.1
linux-image-aws-hwe 4.15.0.1088.82
linux-image-azure 4.15.0.1100.93
linux-image-azure-edge 4.15.0.1100.93
linux-image-gcp 4.15.0.1088.89
linux-image-generic-hwe-16.04 4.15.0.126.125
linux-image-generic-lpae-hwe-16.04 4.15.0.126.125
linux-image-gke 4.15.0.1088.89
linux-image-lowlatency-hwe-16.04 4.15.0.126.125
linux-image-oem 4.15.0.126.125
linux-image-oracle 4.15.0.1059.48
linux-image-virtual-hwe-16.04 4.15.0.126.125
Ubuntu 14.04 ESM:
linux-image-4.15.0-1100-azure 4.15.0-1100.111~14.04.1
linux-image-azure 4.15.0.1100.75
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4660-1
CVE-2020-14351, CVE-2020-14390, CVE-2020-25211, CVE-2020-25284,
CVE-2020-25285, CVE-2020-25641, CVE-2020-25643, CVE-2020-25645,
CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-126.129
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1088.93
https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1100.111
https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1088.101
https://launchpad.net/ubuntu/+source/linux-gke-4.15/4.15.0-1074.79
https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1079.81
https://launchpad.net/ubuntu/+source/linux-oem/4.15.0-1103.114
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1059.65
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1074.79
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1091.100
https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1088.93~16.04.1
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1100.111~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1088.101~16.04.1
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-126.129~16.04.1
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1059.65~16.04.1
Ubuntu Security Notice USN-4660-1
December 03, 2020
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem,
linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-4.15: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oem: Linux kernel for OEM systems
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2020-25211)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)
It was discovered that the block layer subsystem in the Linux kernel did
not properly handle zero-length requests. A local attacker could use this
to cause a denial of service. (CVE-2020-25641)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1059-oracle 4.15.0-1059.65
linux-image-4.15.0-1074-gke 4.15.0-1074.79
linux-image-4.15.0-1074-raspi2 4.15.0-1074.79
linux-image-4.15.0-1079-kvm 4.15.0-1079.81
linux-image-4.15.0-1088-aws 4.15.0-1088.93
linux-image-4.15.0-1088-gcp 4.15.0-1088.101
linux-image-4.15.0-1091-snapdragon 4.15.0-1091.100
linux-image-4.15.0-1100-azure 4.15.0-1100.111
linux-image-4.15.0-1103-oem 4.15.0-1103.114
linux-image-4.15.0-126-generic 4.15.0-126.129
linux-image-4.15.0-126-generic-lpae 4.15.0-126.129
linux-image-4.15.0-126-lowlatency 4.15.0-126.129
linux-image-aws-lts-18.04 4.15.0.1088.90
linux-image-azure-lts-18.04 4.15.0.1100.73
linux-image-gcp-lts-18.04 4.15.0.1088.106
linux-image-generic 4.15.0.126.113
linux-image-generic-lpae 4.15.0.126.113
linux-image-gke 4.15.0.1074.78
linux-image-gke-4.15 4.15.0.1074.78
linux-image-kvm 4.15.0.1079.75
linux-image-lowlatency 4.15.0.126.113
linux-image-oem 4.15.0.1103.107
linux-image-oracle-lts-18.04 4.15.0.1059.69
linux-image-powerpc-e500mc 4.15.0.126.113
linux-image-powerpc-smp 4.15.0.126.113
linux-image-powerpc64-emb 4.15.0.126.113
linux-image-powerpc64-smp 4.15.0.126.113
linux-image-raspi2 4.15.0.1074.71
linux-image-snapdragon 4.15.0.1091.94
linux-image-virtual 4.15.0.126.113
Ubuntu 16.04 LTS:
linux-image-4.15.0-1059-oracle 4.15.0-1059.65~16.04.1
linux-image-4.15.0-1088-aws 4.15.0-1088.93~16.04.1
linux-image-4.15.0-1088-gcp 4.15.0-1088.101~16.04.1
linux-image-4.15.0-1100-azure 4.15.0-1100.111~16.04.1
linux-image-4.15.0-126-generic 4.15.0-126.129~16.04.1
linux-image-4.15.0-126-generic-lpae 4.15.0-126.129~16.04.1
linux-image-4.15.0-126-lowlatency 4.15.0-126.129~16.04.1
linux-image-aws-hwe 4.15.0.1088.82
linux-image-azure 4.15.0.1100.93
linux-image-azure-edge 4.15.0.1100.93
linux-image-gcp 4.15.0.1088.89
linux-image-generic-hwe-16.04 4.15.0.126.125
linux-image-generic-lpae-hwe-16.04 4.15.0.126.125
linux-image-gke 4.15.0.1088.89
linux-image-lowlatency-hwe-16.04 4.15.0.126.125
linux-image-oem 4.15.0.126.125
linux-image-oracle 4.15.0.1059.48
linux-image-virtual-hwe-16.04 4.15.0.126.125
Ubuntu 14.04 ESM:
linux-image-4.15.0-1100-azure 4.15.0-1100.111~14.04.1
linux-image-azure 4.15.0.1100.75
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4660-1
CVE-2020-14351, CVE-2020-14390, CVE-2020-25211, CVE-2020-25284,
CVE-2020-25285, CVE-2020-25641, CVE-2020-25643, CVE-2020-25645,
CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-126.129
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1088.93
https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1100.111
https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1088.101
https://launchpad.net/ubuntu/+source/linux-gke-4.15/4.15.0-1074.79
https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1079.81
https://launchpad.net/ubuntu/+source/linux-oem/4.15.0-1103.114
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1059.65
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1074.79
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1091.100
https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1088.93~16.04.1
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1100.111~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1088.101~16.04.1
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-126.129~16.04.1
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1059.65~16.04.1
Re: Fedora 33 elections voting now open
This is your reminder that voting in the Fedora 33 elections remains
open through 23:59 UTC Thursday (slightly less than 30 hours from the
time I send this).
Elections results will be announced sometime on Friday.
On Wed, Nov 18, 2020 at 7:13 PM Ben Cotton <bcotton@redhat.com> wrote:
>
> Voting in the Fedora 33 elections is now open. Go to the Elections app
> to cast[1] your vote. Voting closes at 23:59 UTC on Thursday 3
> December. Don't forget to claim your "I Voted" badge when you cast
> your ballot. Links to candidate interviews are in the Elections app
> and on the
> Community Blog[2].
>
> [1] https://elections.fedoraproject.org/
> [2] https://communityblog.fedoraproject.org/fedora-33-elections-voting-now-open/
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
open through 23:59 UTC Thursday (slightly less than 30 hours from the
time I send this).
Elections results will be announced sometime on Friday.
On Wed, Nov 18, 2020 at 7:13 PM Ben Cotton <bcotton@redhat.com> wrote:
>
> Voting in the Fedora 33 elections is now open. Go to the Elections app
> to cast[1] your vote. Voting closes at 23:59 UTC on Thursday 3
> December. Don't forget to claim your "I Voted" badge when you cast
> your ballot. Links to candidate interviews are in the Elections app
> and on the
> Community Blog[2].
>
> [1] https://elections.fedoraproject.org/
> [2] https://communityblog.fedoraproject.org/fedora-33-elections-voting-now-open/
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34 Change: Ruby 3.0 (System-Wide Change)
https://fedoraproject.org/wiki/Changes/Ruby_3.0
== Summary ==
Ruby 3.0 is the latest stable version of Ruby. Many new features and
improvements are included for the increasingly diverse and expanding
demands for Ruby. With this major update from Ruby 2.7 in Fedora 33 to
Ruby 3.0 in Fedora 34, Fedora becomes the superior Ruby development
platform.
== Owner ==
* Name: [[User:vondruch| Vít Ondruch]], [[User:pvalena| Pavel Valena]]
* Email: vondruch@redhat.com, pvalena@redhat.com
== Detailed Description ==
<!-- Expand on the summary, if appropriate. A couple sentences
suffices to explain the goal, but the more details you can provide the
better. -->
Ruby 3.0 is upstream's new major release of Ruby. Many new features
and improvements are included.
=== RBS ===
RBS is a language to describe the types of Ruby programs. Type
checkers including type-profiler and other tools supporting RBS will
understand Ruby programs much better with RBS definitions.
You can write down the definition of classes and modules: methods
defined in the class, instance variables and their types, and
inheritance/mix-in relations. The goal of RBS is to support commonly
seen patterns in Ruby programs and it allows writing advanced types
including union types, method overloading, and generics. It also
supports duck typing with interface types.
Ruby 3.0 ships with `rbs` gem, which allows parsing and processing
type definitions written in RBS.
=== Ractor (experimental) ===
Ractor is an Actor-model like concurrent abstraction designed to
provide a parallel execution feature without thread-safety concerns.
You can make multiple ractors and you can run them in parallel. Ractor
enables to make thread-safe parallel programs because ractors can not
share normal objects. Communication between ractors are supported by
message passing.
To limit sharing objects, Ractor introduces several restrictions to
the Ruby's syntax (without multiple Ractors, there is no changes).
The specification and implementation are not matured and changed in
future, so this feature is marked as experimental and show the
experimental feature warning if Ractor is created.
=== Scheduler (Experimental) ===
`Thread#scheduler` is introduced for intercepting blocking operations.
This allows for light-weight concurrency without changing existing
code.
CAUTION: This feature is strongly experimental. Both the name and
feature will change in next preview release.
=== Other Notable New Features ===
* Rightward assignment statement is added.
* Endless method definition is added.
* Find pattern is added.
* `Hash#except` is now built-in.
* Memory view is added as an experimental feature
=== Performance improvements ===
Many improvements were implemented in MJIT.
=== Other notable changes since 2.7 ===
* Keyword arguments are separated from other arguments.
* The feature of `$SAFE` was completely removed; now it is a normal
global variable.
* The order of backtrace had been reversed at Ruby 2.5, but it was
cancelled. Now it behaves like Ruby 2.4; an error message and the line
number where the exception occurs are printed first, and its callers
are printed later.
* Some standard libraries are updated.
== Benefit to Fedora ==
With a latest release, Ruby language is supporting the newest language
features, which enables even faster and easier development of Ruby
applications.
== Scope ==
* Proposal owners:
** Finish packaging of Ruby 3.0. Current changes available in PR
https://src.fedoraproject.org/rpms/ruby/pull-request/70
** Rebuilding of Ruby packages providing native extensions (i.e.
packages which depends on libruby).
* Other developers:
** Rebuild of packages with binary extensions (i.e. packages which
depends on libruby) will be handled automatically, but some packages
might need fixes/updates to support Ruby 3.0 properly.
* Release engineering: [https://pagure.io/releng/issue/9882 #9882] (a
check of an impact with Release Engineering is needed)
** The packages are going to be rebuild in side-tag, but that does not
need releng involvement nowadays.
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
* User specific Ruby binary extensions need to be rebuild.
== How To Test ==
* No special hardware is needed.
* To test, install Ruby 3.0. The test builds are pusblished in PR or
on Ruby-SIG ML
* Try to locally rebuild your packages using Ruby 3.0.
* Use the packages with your applications previously written in Ruby.
* If something doesn't work as it should, let us know.
== User Experience ==
The Ruby programs/scripts should behave as they were used to.
== Dependencies ==
<pre>
$ dnf repoquery --disablerepo=* --enablerepo=rawhide
--enablerepo=rawhide-source --arch=src --whatrequires 'ruby-devel' |
sort | uniq | wc -l
138
</pre>
== Contingency Plan ==
* Contingency mechanism: We would like to get a special buildroot tag
to be able to rebuild necessary the packages with Ruby 3.0. If
anything goes wrong, the tag could be easily dropped and previous
version of Ruby 2.7 and its dependencies stays intact. The tag would
be merged into F34 after everything is rebuild.
* Contingency deadline: Mass Rebuild
* Blocks release? No (not a System Wide Change), Yes/No
* Blocks product? No
== Documentation ==
* [http://www.ruby-doc.org/ Help and documentation for the Ruby
programming language]
* [https://github.com/ruby/ruby/blob/v3_0_0_preview1/NEWS.md Ruby
3.0.0.preview1 NEWS]
== Release Notes ==
* The Ruby 3.0 bumps soname, therefore Ruby packages, which use binary
extensions, should be rebuilt. Nevertheless, since upstream paid great
attention to source compatibility, no changes to your code are needed.
https://github.com/ruby/ruby/blob/master/NEWS
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
Ruby 3.0 is the latest stable version of Ruby. Many new features and
improvements are included for the increasingly diverse and expanding
demands for Ruby. With this major update from Ruby 2.7 in Fedora 33 to
Ruby 3.0 in Fedora 34, Fedora becomes the superior Ruby development
platform.
== Owner ==
* Name: [[User:vondruch| Vít Ondruch]], [[User:pvalena| Pavel Valena]]
* Email: vondruch@redhat.com, pvalena@redhat.com
== Detailed Description ==
<!-- Expand on the summary, if appropriate. A couple sentences
suffices to explain the goal, but the more details you can provide the
better. -->
Ruby 3.0 is upstream's new major release of Ruby. Many new features
and improvements are included.
=== RBS ===
RBS is a language to describe the types of Ruby programs. Type
checkers including type-profiler and other tools supporting RBS will
understand Ruby programs much better with RBS definitions.
You can write down the definition of classes and modules: methods
defined in the class, instance variables and their types, and
inheritance/mix-in relations. The goal of RBS is to support commonly
seen patterns in Ruby programs and it allows writing advanced types
including union types, method overloading, and generics. It also
supports duck typing with interface types.
Ruby 3.0 ships with `rbs` gem, which allows parsing and processing
type definitions written in RBS.
=== Ractor (experimental) ===
Ractor is an Actor-model like concurrent abstraction designed to
provide a parallel execution feature without thread-safety concerns.
You can make multiple ractors and you can run them in parallel. Ractor
enables to make thread-safe parallel programs because ractors can not
share normal objects. Communication between ractors are supported by
message passing.
To limit sharing objects, Ractor introduces several restrictions to
the Ruby's syntax (without multiple Ractors, there is no changes).
The specification and implementation are not matured and changed in
future, so this feature is marked as experimental and show the
experimental feature warning if Ractor is created.
=== Scheduler (Experimental) ===
`Thread#scheduler` is introduced for intercepting blocking operations.
This allows for light-weight concurrency without changing existing
code.
CAUTION: This feature is strongly experimental. Both the name and
feature will change in next preview release.
=== Other Notable New Features ===
* Rightward assignment statement is added.
* Endless method definition is added.
* Find pattern is added.
* `Hash#except` is now built-in.
* Memory view is added as an experimental feature
=== Performance improvements ===
Many improvements were implemented in MJIT.
=== Other notable changes since 2.7 ===
* Keyword arguments are separated from other arguments.
* The feature of `$SAFE` was completely removed; now it is a normal
global variable.
* The order of backtrace had been reversed at Ruby 2.5, but it was
cancelled. Now it behaves like Ruby 2.4; an error message and the line
number where the exception occurs are printed first, and its callers
are printed later.
* Some standard libraries are updated.
== Benefit to Fedora ==
With a latest release, Ruby language is supporting the newest language
features, which enables even faster and easier development of Ruby
applications.
== Scope ==
* Proposal owners:
** Finish packaging of Ruby 3.0. Current changes available in PR
https://src.fedoraproject.org/rpms/ruby/pull-request/70
** Rebuilding of Ruby packages providing native extensions (i.e.
packages which depends on libruby).
* Other developers:
** Rebuild of packages with binary extensions (i.e. packages which
depends on libruby) will be handled automatically, but some packages
might need fixes/updates to support Ruby 3.0 properly.
* Release engineering: [https://pagure.io/releng/issue/9882 #9882] (a
check of an impact with Release Engineering is needed)
** The packages are going to be rebuild in side-tag, but that does not
need releng involvement nowadays.
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
* User specific Ruby binary extensions need to be rebuild.
== How To Test ==
* No special hardware is needed.
* To test, install Ruby 3.0. The test builds are pusblished in PR or
on Ruby-SIG ML
* Try to locally rebuild your packages using Ruby 3.0.
* Use the packages with your applications previously written in Ruby.
* If something doesn't work as it should, let us know.
== User Experience ==
The Ruby programs/scripts should behave as they were used to.
== Dependencies ==
<pre>
$ dnf repoquery --disablerepo=* --enablerepo=rawhide
--enablerepo=rawhide-source --arch=src --whatrequires 'ruby-devel' |
sort | uniq | wc -l
138
</pre>
== Contingency Plan ==
* Contingency mechanism: We would like to get a special buildroot tag
to be able to rebuild necessary the packages with Ruby 3.0. If
anything goes wrong, the tag could be easily dropped and previous
version of Ruby 2.7 and its dependencies stays intact. The tag would
be merged into F34 after everything is rebuild.
* Contingency deadline: Mass Rebuild
* Blocks release? No (not a System Wide Change), Yes/No
* Blocks product? No
== Documentation ==
* [http://www.ruby-doc.org/ Help and documentation for the Ruby
programming language]
* [https://github.com/ruby/ruby/blob/v3_0_0_preview1/NEWS.md Ruby
3.0.0.preview1 NEWS]
== Release Notes ==
* The Ruby 3.0 bumps soname, therefore Ruby packages, which use binary
extensions, should be rebuilt. Nevertheless, since upstream paid great
attention to source compatibility, no changes to your code are needed.
https://github.com/ruby/ruby/blob/master/NEWS
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Upcoming Fedora 34 deadlines
Here we are, already thinking about Change submission deadlines for
Fedora 34! Some key dates you should know:
* 2020-12-16 — Change proposal deadline: Changes requiring
infrastructure changes
* 2020-12-29 — Change proposal deadline: System-Wide Changes, Changes
requiring mass rebuild
* 2021-01-19 — Change proposal deadline: Self-Contained Changes
The full Fedora 34 schedule is on Fedora People:
https://fedorapeople.org/groups/schedule/f-34/f-34-key-tasks.html
I will send additional reminders as we approach the deadlines. You can
also read the weekly Fedora program updates on the Community Blog[2]
or join the FPgM office hours at 9 AM Eastern (currently 1400 UTC) on
Wednesdays[3].
[1] https://fedorapeople.org/groups/schedule/f-34/f-34-key-tasks.html
[2] https://communityblog.fedoraproject.org/category/program-management/
[3] https://apps.fedoraproject.org/calendar/meeting/9527/
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34! Some key dates you should know:
* 2020-12-16 — Change proposal deadline: Changes requiring
infrastructure changes
* 2020-12-29 — Change proposal deadline: System-Wide Changes, Changes
requiring mass rebuild
* 2021-01-19 — Change proposal deadline: Self-Contained Changes
The full Fedora 34 schedule is on Fedora People:
https://fedorapeople.org/groups/schedule/f-34/f-34-key-tasks.html
I will send additional reminders as we approach the deadlines. You can
also read the weekly Fedora program updates on the Community Blog[2]
or join the FPgM office hours at 9 AM Eastern (currently 1400 UTC) on
Wednesdays[3].
[1] https://fedorapeople.org/groups/schedule/f-34/f-34-key-tasks.html
[2] https://communityblog.fedoraproject.org/category/program-management/
[3] https://apps.fedoraproject.org/calendar/meeting/9527/
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34 Change: Make Fedora CoreOS a Fedora Edition (System-Wide Change)
https://fedoraproject.org/wiki/Changes/FedoraCoreOS
== Summary ==
This changes is to promote Fedora CoreOS to Edition status alongside
Workstation, Server and IoT.
== Owners ==
* Name: [[User:cverna|Clement Verna]]
* Email: cverna@fedoraproject.org
* Products: Fedora CoreOS
* Responsible WGs: Fedora CoreOS Group
== Detailed Description ==
This changes is to promote Fedora CoreOS to Edition status alongside
Workstation, Server and IoT.
[https://fedoraproject.org/wiki/Editions/Promotion_Process#Prerequisites
Prerequisites] are tracked bellow :
* Edition has a team with regular public meeting :
[https://apps.fedoraproject.org/calendar/meeting/9437/ weekly meeting
happening on #fedora-meeting-1]
* Trademark approval from the Fedora Council :
[https://pagure.io/Fedora-Council/tickets/issue/340 council ticket]
* Product requirements document (PRD) :
https://fedoraproject.org/wiki/CoreOS/PRD
* Technical specification :
https://github.com/coreos/fedora-coreos-tracker/blob/master/Design.md
== Feedback ==
== Benefit to Fedora ==
Make Fedora CoreOS an official edition, will help spread adoption and
position Fedora as credible solution for running container workflow.
== Scope ==
* Proposal owners: see change owners
* Other developers: N/A
* Release engineering: Fedora CoreOS is already being composed and released.
* Policies and guidelines: N/A
* Trademark approval: https://pagure.io/Fedora-Council/tickets/issue/340
== Upgrade/compatibility impact ==
N/A
== How To Test ==
See QA test cases : https://fedoraproject.org/wiki/Category:CoreOS_Test_Cases
We also have regular tests days, for example
https://fedoramagazine.org/fedora-coreos-test-day/
== User Experience ==
==== Pros ====
==== Enhancement opportunities ====
== Dependencies ==
== Contingency Plan ==
Contingency mechanism: (What to do? Who will do it?) Delay promotion until F35
Contingency deadline: F34 Final release date
Blocks release? No
== Documentation ==
https://docs.fedoraproject.org/en-US/fedora-coreos/
== Release Notes ==
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
This changes is to promote Fedora CoreOS to Edition status alongside
Workstation, Server and IoT.
== Owners ==
* Name: [[User:cverna|Clement Verna]]
* Email: cverna@fedoraproject.org
* Products: Fedora CoreOS
* Responsible WGs: Fedora CoreOS Group
== Detailed Description ==
This changes is to promote Fedora CoreOS to Edition status alongside
Workstation, Server and IoT.
[https://fedoraproject.org/wiki/Editions/Promotion_Process#Prerequisites
Prerequisites] are tracked bellow :
* Edition has a team with regular public meeting :
[https://apps.fedoraproject.org/calendar/meeting/9437/ weekly meeting
happening on #fedora-meeting-1]
* Trademark approval from the Fedora Council :
[https://pagure.io/Fedora-Council/tickets/issue/340 council ticket]
* Product requirements document (PRD) :
https://fedoraproject.org/wiki/CoreOS/PRD
* Technical specification :
https://github.com/coreos/fedora-coreos-tracker/blob/master/Design.md
== Feedback ==
== Benefit to Fedora ==
Make Fedora CoreOS an official edition, will help spread adoption and
position Fedora as credible solution for running container workflow.
== Scope ==
* Proposal owners: see change owners
* Other developers: N/A
* Release engineering: Fedora CoreOS is already being composed and released.
* Policies and guidelines: N/A
* Trademark approval: https://pagure.io/Fedora-Council/tickets/issue/340
== Upgrade/compatibility impact ==
N/A
== How To Test ==
See QA test cases : https://fedoraproject.org/wiki/Category:CoreOS_Test_Cases
We also have regular tests days, for example
https://fedoramagazine.org/fedora-coreos-test-day/
== User Experience ==
==== Pros ====
==== Enhancement opportunities ====
== Dependencies ==
== Contingency Plan ==
Contingency mechanism: (What to do? Who will do it?) Delay promotion until F35
Contingency deadline: F34 Final release date
Blocks release? No
== Documentation ==
https://docs.fedoraproject.org/en-US/fedora-coreos/
== Release Notes ==
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34 Change: ntp replacement (Self-Contained Change)
https://fedoraproject.org/wiki/Changes/NtpReplacement
== Summary ==
The `ntp` package is replaced with `ntpsec`.
== Owner ==
* Name: [[User:mlichvar| Miroslav Lichvar]]
* Email: mlichvar@redhat.com
== Detailed Description ==
`ntp` is one of the few NTP implementations provided in Fedora. It is
not used or installed by default.
The [https://www.ntp.org/ upstream project] is not in a good shape and
it doesn't seem to be improving. The development is slow and happens
behind closed doors. There is a significant number of known security
issues that have not been fixed yet. Some are exploitable in the
default configuration.
[https://www.ntpsec.org/ ntpsec] is a fork of `ntp` with focus on
security. It has removed a lot of code and fixed or avoided most of
the security issues in `ntp`. It doesn't support all features, but in
typical configurations it can be used as a drop-in replacement for
`ntp`.
There are few packages in Fedora that have a dependency on `ntp`:
* `nagios-plugins-ntp-perl`
* `ntpstat`
== Benefit to Fedora ==
This change makes Fedora more secure.
== Scope ==
* Proposal owners:
# Package `ntpsec` obsoleting the `ntp` package.
# Retire `ntp` package.
# Make sure the dependent packages still work.
* Other developers: N/A (not a System Wide Change)
* Release engineering: N/A (not needed for this Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
The `ntp` package is replaced automatically on upgrade to Fedora 34.
The configuration file ''/etc/ntp.conf'' is saved as to
''/etc/ntp.conf.rpmsave'' and it needs to be renamed to
''/etc/ntp.conf'' to be used by `ntpsec`. Otherwise, `ntpsec` will
fall back to the default configuration in ''/etc/ntp.d'' using the
''pool.ntp.org'' servers.
The `ntpd` service is disabled after the upgrade and needs to be enabled again.
== How To Test ==
* Install `ntpsec`
* Run `ntpdate pool.ntp.org`
* Start the `ntpd` service
* Run `ntpq -p` to verify `ntpd` is polling servers and synchronizing the clock
== User Experience ==
For most users of `ntp` the experience is not expected to change
significantly. Advanced configurations may need to be modified to work
with `ntpsec`.
== Dependencies ==
N/A (not a System Wide Change)
== Contingency Plan ==
* Contingency mechanism: Unretire `ntp` and remove the obsoletes in `ntpsec`
* Contingency deadline: Fedora 34 Beta
* Blocks release? N/A (not a System Wide Change)
* Blocks product?
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
TBD
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
The `ntp` package is replaced with `ntpsec`.
== Owner ==
* Name: [[User:mlichvar| Miroslav Lichvar]]
* Email: mlichvar@redhat.com
== Detailed Description ==
`ntp` is one of the few NTP implementations provided in Fedora. It is
not used or installed by default.
The [https://www.ntp.org/ upstream project] is not in a good shape and
it doesn't seem to be improving. The development is slow and happens
behind closed doors. There is a significant number of known security
issues that have not been fixed yet. Some are exploitable in the
default configuration.
[https://www.ntpsec.org/ ntpsec] is a fork of `ntp` with focus on
security. It has removed a lot of code and fixed or avoided most of
the security issues in `ntp`. It doesn't support all features, but in
typical configurations it can be used as a drop-in replacement for
`ntp`.
There are few packages in Fedora that have a dependency on `ntp`:
* `nagios-plugins-ntp-perl`
* `ntpstat`
== Benefit to Fedora ==
This change makes Fedora more secure.
== Scope ==
* Proposal owners:
# Package `ntpsec` obsoleting the `ntp` package.
# Retire `ntp` package.
# Make sure the dependent packages still work.
* Other developers: N/A (not a System Wide Change)
* Release engineering: N/A (not needed for this Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
The `ntp` package is replaced automatically on upgrade to Fedora 34.
The configuration file ''/etc/ntp.conf'' is saved as to
''/etc/ntp.conf.rpmsave'' and it needs to be renamed to
''/etc/ntp.conf'' to be used by `ntpsec`. Otherwise, `ntpsec` will
fall back to the default configuration in ''/etc/ntp.d'' using the
''pool.ntp.org'' servers.
The `ntpd` service is disabled after the upgrade and needs to be enabled again.
== How To Test ==
* Install `ntpsec`
* Run `ntpdate pool.ntp.org`
* Start the `ntpd` service
* Run `ntpq -p` to verify `ntpd` is polling servers and synchronizing the clock
== User Experience ==
For most users of `ntp` the experience is not expected to change
significantly. Advanced configurations may need to be modified to work
with `ntpsec`.
== Dependencies ==
N/A (not a System Wide Change)
== Contingency Plan ==
* Contingency mechanism: Unretire `ntp` and remove the obsoletes in `ntpsec`
* Contingency deadline: Fedora 34 Beta
* Blocks release? N/A (not a System Wide Change)
* Blocks product?
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
TBD
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
[FreeBSD-Announce] FreeBSD-doc Subversion to Git migration
The FreeBSD project is pleased to announce the first transition from
Subversion to Git, for the doc repository.
We will begin the migration sometime on December 5th and hope to be
completed by December 8th. Please see
https://github.com/bsdimp/freebsd-git-docs/blob/main/doc-cutover-schedule.md
for
a detailed schedule.
Once this conversion is complete, Subversion will become read-only with no
further updates to the doc tree. If you are fetching our documentation from
source control, you will need to switch to the new git repository at the
URL listed at
https://github.com/bsdimp/freebsd-git-docs/blob/main/doc-cvt.md at the
top. Prior
to the cutover, the Subversion repository will be mirrored there. Please
see http://github.com/bsdimp/freebsd-git-docs for documentation on this and
other upcoming migrations. The FreeBSD handbook and website will update
from the appropriate repository, and will be unaffected by this change over.
As part of this conversion, we will be hosting office hours this Thursday
18:00 UTC, and at additional times in the future. For details please see
https://wiki.freebsd.org/OfficeHours. In addition, we will be monitoring
#gitcvt on EFnet (irc.efnet.org) and #git on the unofficial FreeBSD Discord
server (https://discord.gg/WKEKSPtJGp) for people encountering problems
during and after the cutover.
For the history about this transition, please see the git@freebsd.org archives
at https://lists.freebsd.org/pipermail/freebsd-git/.
Warner Losh and Ed Maste, on behalf of the git conversion working group.
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Subversion to Git, for the doc repository.
We will begin the migration sometime on December 5th and hope to be
completed by December 8th. Please see
https://github.com/bsdimp/freebsd-git-docs/blob/main/doc-cutover-schedule.md
for
a detailed schedule.
Once this conversion is complete, Subversion will become read-only with no
further updates to the doc tree. If you are fetching our documentation from
source control, you will need to switch to the new git repository at the
URL listed at
https://github.com/bsdimp/freebsd-git-docs/blob/main/doc-cvt.md at the
top. Prior
to the cutover, the Subversion repository will be mirrored there. Please
see http://github.com/bsdimp/freebsd-git-docs for documentation on this and
other upcoming migrations. The FreeBSD handbook and website will update
from the appropriate repository, and will be unaffected by this change over.
As part of this conversion, we will be hosting office hours this Thursday
18:00 UTC, and at additional times in the future. For details please see
https://wiki.freebsd.org/OfficeHours. In addition, we will be monitoring
#gitcvt on EFnet (irc.efnet.org) and #git on the unofficial FreeBSD Discord
server (https://discord.gg/WKEKSPtJGp) for people encountering problems
during and after the cutover.
For the history about this transition, please see the git@freebsd.org archives
at https://lists.freebsd.org/pipermail/freebsd-git/.
Warner Losh and Ed Maste, on behalf of the git conversion working group.
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Tuesday, December 1, 2020
[USN-4658-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4658-1
December 02, 2020
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp,
linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems
- linux-gcp-5.4: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe-5.4: Linux hardware enablement (HWE) kernel
- linux-oracle-5.4: Linux kernel for Oracle Cloud systems
Details:
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2020-25211)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)
Keyu Man discovered that the ICMP global rate limiter in the Linux kernel
could be used to assist in scanning open UDP ports. A remote attacker could
use to facilitate attacks on UDP based services that depend on source port
randomization. (CVE-2020-25705)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1028-kvm 5.4.0-1028.29
linux-image-5.4.0-1030-aws 5.4.0-1030.31
linux-image-5.4.0-1030-gcp 5.4.0-1030.32
linux-image-5.4.0-1030-oracle 5.4.0-1030.32
linux-image-5.4.0-1032-azure 5.4.0-1032.33
linux-image-5.4.0-56-generic 5.4.0-56.62
linux-image-5.4.0-56-generic-lpae 5.4.0-56.62
linux-image-5.4.0-56-lowlatency 5.4.0-56.62
linux-image-aws 5.4.0.1030.31
linux-image-azure 5.4.0.1032.30
linux-image-gcp 5.4.0.1030.38
linux-image-generic 5.4.0.56.59
linux-image-generic-hwe-20.04 5.4.0.56.59
linux-image-generic-lpae 5.4.0.56.59
linux-image-generic-lpae-hwe-20.04 5.4.0.56.59
linux-image-gke 5.4.0.1030.38
linux-image-kvm 5.4.0.1028.26
linux-image-lowlatency 5.4.0.56.59
linux-image-lowlatency-hwe-20.04 5.4.0.56.59
linux-image-oem 5.4.0.56.59
linux-image-oem-osp1 5.4.0.56.59
linux-image-oracle 5.4.0.1030.27
linux-image-virtual 5.4.0.56.59
linux-image-virtual-hwe-20.04 5.4.0.56.59
Ubuntu 18.04 LTS:
linux-image-5.4.0-1030-aws 5.4.0-1030.31~18.04.1
linux-image-5.4.0-1030-gcp 5.4.0-1030.32~18.04.1
linux-image-5.4.0-1030-oracle 5.4.0-1030.32~18.04.1
linux-image-5.4.0-1032-azure 5.4.0-1032.33~18.04.1
linux-image-5.4.0-56-generic 5.4.0-56.62~18.04.1
linux-image-5.4.0-56-generic-lpae 5.4.0-56.62~18.04.1
linux-image-5.4.0-56-lowlatency 5.4.0-56.62~18.04.1
linux-image-aws 5.4.0.1030.15
linux-image-azure 5.4.0.1032.14
linux-image-gcp 5.4.0.1030.18
linux-image-generic-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-generic-lpae-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-lowlatency-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-oem-osp1 5.4.0.56.62~18.04.50
linux-image-oracle 5.4.0.1030.14
linux-image-snapdragon-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-virtual-hwe-18.04 5.4.0.56.62~18.04.50
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4658-1
CVE-2020-0423, CVE-2020-10135, CVE-2020-14351, CVE-2020-14390,
CVE-2020-25211, CVE-2020-25284, CVE-2020-25643, CVE-2020-25645,
CVE-2020-25705, CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.4.0-56.62
https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1030.31
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1032.33
https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1030.32
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1028.29
https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1030.32
https://launchpad.net/ubuntu/+source/linux-aws-5.4/5.4.0-1030.31~18.04.1
https://launchpad.net/ubuntu/+source/linux-azure-5.4/5.4.0-1032.33~18.04.1
https://launchpad.net/ubuntu/+source/linux-gcp-5.4/5.4.0-1030.32~18.04.1
https://launchpad.net/ubuntu/+source/linux-hwe-5.4/5.4.0-56.62~18.04.1
https://launchpad.net/ubuntu/+source/linux-oracle-5.4/5.4.0-1030.32~18.04.1
Ubuntu Security Notice USN-4658-1
December 02, 2020
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp,
linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems
- linux-gcp-5.4: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe-5.4: Linux hardware enablement (HWE) kernel
- linux-oracle-5.4: Linux kernel for Oracle Cloud systems
Details:
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2020-25211)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)
Keyu Man discovered that the ICMP global rate limiter in the Linux kernel
could be used to assist in scanning open UDP ports. A remote attacker could
use to facilitate attacks on UDP based services that depend on source port
randomization. (CVE-2020-25705)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1028-kvm 5.4.0-1028.29
linux-image-5.4.0-1030-aws 5.4.0-1030.31
linux-image-5.4.0-1030-gcp 5.4.0-1030.32
linux-image-5.4.0-1030-oracle 5.4.0-1030.32
linux-image-5.4.0-1032-azure 5.4.0-1032.33
linux-image-5.4.0-56-generic 5.4.0-56.62
linux-image-5.4.0-56-generic-lpae 5.4.0-56.62
linux-image-5.4.0-56-lowlatency 5.4.0-56.62
linux-image-aws 5.4.0.1030.31
linux-image-azure 5.4.0.1032.30
linux-image-gcp 5.4.0.1030.38
linux-image-generic 5.4.0.56.59
linux-image-generic-hwe-20.04 5.4.0.56.59
linux-image-generic-lpae 5.4.0.56.59
linux-image-generic-lpae-hwe-20.04 5.4.0.56.59
linux-image-gke 5.4.0.1030.38
linux-image-kvm 5.4.0.1028.26
linux-image-lowlatency 5.4.0.56.59
linux-image-lowlatency-hwe-20.04 5.4.0.56.59
linux-image-oem 5.4.0.56.59
linux-image-oem-osp1 5.4.0.56.59
linux-image-oracle 5.4.0.1030.27
linux-image-virtual 5.4.0.56.59
linux-image-virtual-hwe-20.04 5.4.0.56.59
Ubuntu 18.04 LTS:
linux-image-5.4.0-1030-aws 5.4.0-1030.31~18.04.1
linux-image-5.4.0-1030-gcp 5.4.0-1030.32~18.04.1
linux-image-5.4.0-1030-oracle 5.4.0-1030.32~18.04.1
linux-image-5.4.0-1032-azure 5.4.0-1032.33~18.04.1
linux-image-5.4.0-56-generic 5.4.0-56.62~18.04.1
linux-image-5.4.0-56-generic-lpae 5.4.0-56.62~18.04.1
linux-image-5.4.0-56-lowlatency 5.4.0-56.62~18.04.1
linux-image-aws 5.4.0.1030.15
linux-image-azure 5.4.0.1032.14
linux-image-gcp 5.4.0.1030.18
linux-image-generic-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-generic-lpae-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-lowlatency-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-oem-osp1 5.4.0.56.62~18.04.50
linux-image-oracle 5.4.0.1030.14
linux-image-snapdragon-hwe-18.04 5.4.0.56.62~18.04.50
linux-image-virtual-hwe-18.04 5.4.0.56.62~18.04.50
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4658-1
CVE-2020-0423, CVE-2020-10135, CVE-2020-14351, CVE-2020-14390,
CVE-2020-25211, CVE-2020-25284, CVE-2020-25643, CVE-2020-25645,
CVE-2020-25705, CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.4.0-56.62
https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1030.31
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1032.33
https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1030.32
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1028.29
https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1030.32
https://launchpad.net/ubuntu/+source/linux-aws-5.4/5.4.0-1030.31~18.04.1
https://launchpad.net/ubuntu/+source/linux-azure-5.4/5.4.0-1032.33~18.04.1
https://launchpad.net/ubuntu/+source/linux-gcp-5.4/5.4.0-1030.32~18.04.1
https://launchpad.net/ubuntu/+source/linux-hwe-5.4/5.4.0-56.62~18.04.1
https://launchpad.net/ubuntu/+source/linux-oracle-5.4/5.4.0-1030.32~18.04.1
[USN-4659-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4659-1
December 02, 2020
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oracle,
linux-raspi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi (V8) systems
Details:
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
Keyu Man discovered that the ICMP global rate limiter in the Linux kernel
could be used to assist in scanning open UDP ports. A remote attacker could
use to facilitate attacks on UDP based services that depend on source port
randomization. (CVE-2020-25705)
It was discovered that the KVM hypervisor in the Linux kernel did not
properly handle interrupts in certain situations. A local attacker in a
guest VM could possibly use this to cause a denial of service (host system
crash). (CVE-2020-27152)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
linux-image-5.8.0-1008-raspi 5.8.0-1008.11
linux-image-5.8.0-1008-raspi-nolpae 5.8.0-1008.11
linux-image-5.8.0-1011-kvm 5.8.0-1011.12
linux-image-5.8.0-1011-oracle 5.8.0-1011.11
linux-image-5.8.0-1012-gcp 5.8.0-1012.12
linux-image-5.8.0-1013-azure 5.8.0-1013.14
linux-image-5.8.0-1014-aws 5.8.0-1014.15
linux-image-5.8.0-31-generic 5.8.0-31.33
linux-image-5.8.0-31-generic-64k 5.8.0-31.33
linux-image-5.8.0-31-generic-lpae 5.8.0-31.33
linux-image-5.8.0-31-lowlatency 5.8.0-31.33
linux-image-aws 5.8.0.1014.16
linux-image-azure 5.8.0.1013.13
linux-image-gcp 5.8.0.1012.12
linux-image-generic 5.8.0.31.36
linux-image-generic-64k 5.8.0.31.36
linux-image-generic-lpae 5.8.0.31.36
linux-image-gke 5.8.0.1012.12
linux-image-kvm 5.8.0.1011.12
linux-image-lowlatency 5.8.0.31.36
linux-image-oem-20.04 5.8.0.31.36
linux-image-oracle 5.8.0.1011.11
linux-image-raspi 5.8.0.1008.11
linux-image-raspi-nolpae 5.8.0.1008.11
linux-image-virtual 5.8.0.31.36
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4659-1
CVE-2020-0423, CVE-2020-10135, CVE-2020-14351, CVE-2020-25705,
CVE-2020-27152, CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.8.0-31.33
https://launchpad.net/ubuntu/+source/linux-aws/5.8.0-1014.15
https://launchpad.net/ubuntu/+source/linux-azure/5.8.0-1013.14
https://launchpad.net/ubuntu/+source/linux-gcp/5.8.0-1012.12
https://launchpad.net/ubuntu/+source/linux-kvm/5.8.0-1011.12
https://launchpad.net/ubuntu/+source/linux-oracle/5.8.0-1011.11
https://launchpad.net/ubuntu/+source/linux-raspi/5.8.0-1008.11
Ubuntu Security Notice USN-4659-1
December 02, 2020
linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oracle,
linux-raspi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi (V8) systems
Details:
It was discovered that a race condition existed in the binder IPC
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-0423)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
Keyu Man discovered that the ICMP global rate limiter in the Linux kernel
could be used to assist in scanning open UDP ports. A remote attacker could
use to facilitate attacks on UDP based services that depend on source port
randomization. (CVE-2020-25705)
It was discovered that the KVM hypervisor in the Linux kernel did not
properly handle interrupts in certain situations. A local attacker in a
guest VM could possibly use this to cause a denial of service (host system
crash). (CVE-2020-27152)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
linux-image-5.8.0-1008-raspi 5.8.0-1008.11
linux-image-5.8.0-1008-raspi-nolpae 5.8.0-1008.11
linux-image-5.8.0-1011-kvm 5.8.0-1011.12
linux-image-5.8.0-1011-oracle 5.8.0-1011.11
linux-image-5.8.0-1012-gcp 5.8.0-1012.12
linux-image-5.8.0-1013-azure 5.8.0-1013.14
linux-image-5.8.0-1014-aws 5.8.0-1014.15
linux-image-5.8.0-31-generic 5.8.0-31.33
linux-image-5.8.0-31-generic-64k 5.8.0-31.33
linux-image-5.8.0-31-generic-lpae 5.8.0-31.33
linux-image-5.8.0-31-lowlatency 5.8.0-31.33
linux-image-aws 5.8.0.1014.16
linux-image-azure 5.8.0.1013.13
linux-image-gcp 5.8.0.1012.12
linux-image-generic 5.8.0.31.36
linux-image-generic-64k 5.8.0.31.36
linux-image-generic-lpae 5.8.0.31.36
linux-image-gke 5.8.0.1012.12
linux-image-kvm 5.8.0.1011.12
linux-image-lowlatency 5.8.0.31.36
linux-image-oem-20.04 5.8.0.31.36
linux-image-oracle 5.8.0.1011.11
linux-image-raspi 5.8.0.1008.11
linux-image-raspi-nolpae 5.8.0.1008.11
linux-image-virtual 5.8.0.31.36
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4659-1
CVE-2020-0423, CVE-2020-10135, CVE-2020-14351, CVE-2020-25705,
CVE-2020-27152, CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.8.0-31.33
https://launchpad.net/ubuntu/+source/linux-aws/5.8.0-1014.15
https://launchpad.net/ubuntu/+source/linux-azure/5.8.0-1013.14
https://launchpad.net/ubuntu/+source/linux-gcp/5.8.0-1012.12
https://launchpad.net/ubuntu/+source/linux-kvm/5.8.0-1011.12
https://launchpad.net/ubuntu/+source/linux-oracle/5.8.0-1011.11
https://launchpad.net/ubuntu/+source/linux-raspi/5.8.0-1008.11
[USN-4657-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4657-1
December 02, 2020
linux, linux-aws, linux-azure, linux-kvm, linux-lts-trusty, linux-raspi2,
linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
Elena Petrova discovered that the pin controller device tree implementation
in the Linux kernel did not properly handle string references. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-0427)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2020-25211)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)
Keyu Man discovered that the ICMP global rate limiter in the Linux kernel
could be used to assist in scanning open UDP ports. A remote attacker could
use to facilitate attacks on UDP based services that depend on source port
randomization. (CVE-2020-25705)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1084-kvm 4.4.0-1084.93
linux-image-4.4.0-1118-aws 4.4.0-1118.132
linux-image-4.4.0-1142-raspi2 4.4.0-1142.152
linux-image-4.4.0-1146-snapdragon 4.4.0-1146.156
linux-image-4.4.0-197-generic 4.4.0-197.229
linux-image-4.4.0-197-generic-lpae 4.4.0-197.229
linux-image-4.4.0-197-lowlatency 4.4.0-197.229
linux-image-4.4.0-197-powerpc-e500mc 4.4.0-197.229
linux-image-4.4.0-197-powerpc-smp 4.4.0-197.229
linux-image-4.4.0-197-powerpc64-emb 4.4.0-197.229
linux-image-4.4.0-197-powerpc64-smp 4.4.0-197.229
linux-image-aws 4.4.0.1118.123
linux-image-generic 4.4.0.197.203
linux-image-generic-lpae 4.4.0.197.203
linux-image-kvm 4.4.0.1084.82
linux-image-lowlatency 4.4.0.197.203
linux-image-powerpc-e500mc 4.4.0.197.203
linux-image-powerpc-smp 4.4.0.197.203
linux-image-powerpc64-emb 4.4.0.197.203
linux-image-powerpc64-smp 4.4.0.197.203
linux-image-raspi2 4.4.0.1142.142
linux-image-snapdragon 4.4.0.1146.138
linux-image-virtual 4.4.0.197.203
Ubuntu 14.04 ESM:
linux-image-4.4.0-1082-aws 4.4.0-1082.86
linux-image-4.4.0-197-generic 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-generic-lpae 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-lowlatency 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc-e500mc 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc-smp 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc64-emb 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc64-smp 4.4.0-197.229~14.04.1
linux-image-aws 4.4.0.1082.79
linux-image-generic-lpae-lts-xenial 4.4.0.197.172
linux-image-generic-lts-xenial 4.4.0.197.172
linux-image-lowlatency-lts-xenial 4.4.0.197.172
linux-image-powerpc-e500mc-lts-xenial 4.4.0.197.172
linux-image-powerpc-smp-lts-xenial 4.4.0.197.172
linux-image-powerpc64-emb-lts-xenial 4.4.0.197.172
linux-image-powerpc64-smp-lts-xenial 4.4.0.197.172
linux-image-virtual-lts-xenial 4.4.0.197.172
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4657-1
CVE-2020-0427, CVE-2020-10135, CVE-2020-12352, CVE-2020-14351,
CVE-2020-14390, CVE-2020-25211, CVE-2020-25284, CVE-2020-25643,
CVE-2020-25645, CVE-2020-25705, CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-197.229
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1118.132
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1084.93
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1142.152
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1146.156
Ubuntu Security Notice USN-4657-1
December 02, 2020
linux, linux-aws, linux-azure, linux-kvm, linux-lts-trusty, linux-raspi2,
linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
Elena Petrova discovered that the pin controller device tree implementation
in the Linux kernel did not properly handle string references. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-0427)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
It was discovered that a race condition existed in the perf subsystem of
the Linux kernel, leading to a use-after-free vulnerability. An attacker
with access to the perf subsystem could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)
It was discovered that the frame buffer implementation in the Linux kernel
did not properly handle some edge cases in software scrollback. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-14390)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2020-25211)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
It was discovered that the GENEVE tunnel implementation in the Linux kernel
when combined with IPSec did not properly select IP routes in some
situations. An attacker could use this to expose sensitive information
(unencrypted network traffic). (CVE-2020-25645)
Keyu Man discovered that the ICMP global rate limiter in the Linux kernel
could be used to assist in scanning open UDP ports. A remote attacker could
use to facilitate attacks on UDP based services that depend on source port
randomization. (CVE-2020-25705)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
It was discovered that Power 9 processors could be coerced to expose
information from the L1 cache in certain situations. A local attacker could
use this to expose sensitive information. (CVE-2020-4788)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1084-kvm 4.4.0-1084.93
linux-image-4.4.0-1118-aws 4.4.0-1118.132
linux-image-4.4.0-1142-raspi2 4.4.0-1142.152
linux-image-4.4.0-1146-snapdragon 4.4.0-1146.156
linux-image-4.4.0-197-generic 4.4.0-197.229
linux-image-4.4.0-197-generic-lpae 4.4.0-197.229
linux-image-4.4.0-197-lowlatency 4.4.0-197.229
linux-image-4.4.0-197-powerpc-e500mc 4.4.0-197.229
linux-image-4.4.0-197-powerpc-smp 4.4.0-197.229
linux-image-4.4.0-197-powerpc64-emb 4.4.0-197.229
linux-image-4.4.0-197-powerpc64-smp 4.4.0-197.229
linux-image-aws 4.4.0.1118.123
linux-image-generic 4.4.0.197.203
linux-image-generic-lpae 4.4.0.197.203
linux-image-kvm 4.4.0.1084.82
linux-image-lowlatency 4.4.0.197.203
linux-image-powerpc-e500mc 4.4.0.197.203
linux-image-powerpc-smp 4.4.0.197.203
linux-image-powerpc64-emb 4.4.0.197.203
linux-image-powerpc64-smp 4.4.0.197.203
linux-image-raspi2 4.4.0.1142.142
linux-image-snapdragon 4.4.0.1146.138
linux-image-virtual 4.4.0.197.203
Ubuntu 14.04 ESM:
linux-image-4.4.0-1082-aws 4.4.0-1082.86
linux-image-4.4.0-197-generic 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-generic-lpae 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-lowlatency 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc-e500mc 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc-smp 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc64-emb 4.4.0-197.229~14.04.1
linux-image-4.4.0-197-powerpc64-smp 4.4.0-197.229~14.04.1
linux-image-aws 4.4.0.1082.79
linux-image-generic-lpae-lts-xenial 4.4.0.197.172
linux-image-generic-lts-xenial 4.4.0.197.172
linux-image-lowlatency-lts-xenial 4.4.0.197.172
linux-image-powerpc-e500mc-lts-xenial 4.4.0.197.172
linux-image-powerpc-smp-lts-xenial 4.4.0.197.172
linux-image-powerpc64-emb-lts-xenial 4.4.0.197.172
linux-image-powerpc64-smp-lts-xenial 4.4.0.197.172
linux-image-virtual-lts-xenial 4.4.0.197.172
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4657-1
CVE-2020-0427, CVE-2020-10135, CVE-2020-12352, CVE-2020-14351,
CVE-2020-14390, CVE-2020-25211, CVE-2020-25284, CVE-2020-25643,
CVE-2020-25645, CVE-2020-25705, CVE-2020-28915, CVE-2020-4788
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-197.229
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1118.132
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1084.93
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1142.152
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1146.156
Subscribe to:
Posts (Atom)