Summary
USN-3732-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel
performed algorithmically expensive operations in some situations when
handling incoming packets. A remote attacker could use this to cause a
denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux-azure | 4.15.0-1019.19~16.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-gcp | 4.15.0-1015.15~16.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-hwe | 4.15.0-30.32~16.04.1 |
Vulnerabilities 1
-
Unscored —CVE-2018-5390 EPSS 72%
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.
References
-
report
https://ubuntu.com/security/CVE-2018-5390