USN-4095-1

Advisory lineage Upstream: 16 Downstream: 0
Published: 13 Aug 2019, 16:19
Last modified:07 Sept 2026, 14:06

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Aug 2019, 16:19
Published
Vulnerability first disclosed
07 Sept 2026, 14:06
Last Modified
Vulnerability information updated

Description

linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An attacker could use this to expose sensitive information. (CVE-2018-5383) It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126) Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-1125) Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2019-11599) It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for allocation errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-12614) Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record credentials in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2019-13272) It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846)

Affected Systems

  • ubuntu•linux

    < 4.4.0-159.187

  • ubuntu•linux-aws

    < 4.4.0-1090.101

  • ubuntu•linux-kvm

    < 4.4.0-1054.61

  • ubuntu•linux-raspi2

    < 4.4.0-1118.127

  • ubuntu•linux-snapdragon

    < 4.4.0-1122.128

References (9)