USN-3364-3: Linux kernel (AWS, GKE) vulnerabilities

Ubuntu Security Notice USN-3364-3

25th July, 2017

linux-aws, linux-gke vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

• linux-aws
  - Linux kernel for Amazon Web Services (AWS) systems
  
  





• linux-gke
  - Linux kernel for Google Container Engine (GKE) systems
  
  

Details

It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). ()

Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
()

Jann Horn discovered that bpf in Linux kernel does not restrict the output
of the print_bpf_insn function. A local attacker could use this to obtain
sensitive address information. ()

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:

linux-image-aws 4.4.0.1026.29

linux-image-gke 4.4.0.1022.24

To update your system, please follow these instructions:
,

,

,

CVE-2017-9605