USN-3249-1: Linux kernel vulnerability

Ubuntu Security Notice USN-3249-1

29th March, 2017

linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.04 LTS

Summary

The system could be made to crash or run programs as an administrator.

Software description

• linux
  - Linux kernel
  
  





• linux-aws
  - Linux kernel for Amazon Web Services (AWS) systems
  
  





• linux-gke
  - Linux kernel for Google Container Engine (GKE) systems
  
  





• linux-raspi2
  - Linux kernel for Raspberry Pi 2
  
  





• linux-snapdragon
  - Linux kernel for Snapdragon Processors
  
  

Details

It was discovered that the xfrm framework for transforming packets in the
Linux kernel did not properly validate data received from user space. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code with administrative privileges.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:

linux-image-gke 4.4.0.1009.11

linux-image-powerpc-e500mc 4.4.0.71.77

linux-image-raspi2 4.4.0.1051.52

linux-image-powerpc-smp 4.4.0.71.77

linux-image-generic 4.4.0.71.77

linux-image-generic-lpae 4.4.0.71.77

linux-image-snapdragon 4.4.0.1054.47

linux-image-aws 4.4.0.1012.15

linux-image-lowlatency 4.4.0.71.77

linux-image-powerpc64-smp 4.4.0.71.77

To update your system, please follow these instructions: