Summary
Federico Manuel Bento discovered that the Linux kernel did not properly
apply Address Space Layout Randomization (ASLR) in some situations for
setuid a.out binaries. A local attacker could use this to improve the
chances of exploiting an existing vulnerability in a setuid a.out binary.
As a hardening measure, this update disables a.out support.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux | 4.15.0-51.55 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws | 4.15.0-1040.42 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gcp | 4.15.0-1033.35 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-kvm | 4.15.0-1035.35 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oem | 4.15.0-1039.44 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle | 4.15.0-1014.16 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2 | 4.15.0-1037.39 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-snapdragon | 4.15.0-1054.58 |
Vulnerabilities 1
-
Unscored —
The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass …
References
-
report
https://ubuntu.com/security/CVE-2019-11191