Skip to content
OpenAdvisories
High 1 exploited CVE USN-4118-1 61 CVEs

linux-aws vulnerabilities

Published Sep 2, 2019 · Updated Sep 7, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)

Wen Xu discovered that the XFS filesystem implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)

Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098,
CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14615,
CVE-2018-14616)

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation
in the Linux kernel did not properly validate metadata. An attacker could
use this to construct a malicious btrfs image that, when mounted, could
cause a denial of service (system crash). (CVE-2018-14609, CVE-2018-14610,
CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)

Wen Xu discovered that the HFS+ filesystem implementation in the Linux
kernel did not properly handle malformed catalog data in some situations.
An attacker could use this to construct a malicious HFS+ image that, when
mounted, could cause a denial of service (system crash). (CVE-2018-14617)

Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem
of the Linux kernel did not properly initialize new files in some
situations. A local attacker could use this to expose sensitive
information. (CVE-2018-16862)

Hui Peng and Mathias Payer discovered that the Option USB High Speed driver
in the Linux kernel did not properly validate metadata received from the
device. A physically proximate attacker could use this to cause a denial of
service (system crash). (CVE-2018-19985)

Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux
kernel did not properly handle size checks when handling an extra USB
descriptor. A physically proximate attacker could use this to cause a
denial of service (system crash). (CVE-2018-20169)

Zhipeng Xie discovered that an infinite loop could be triggered in the CFS
Linux kernel process scheduler. A local attacker could possibly use this to
cause a denial of service. (CVE-2018-20784)

It was discovered that a use-after-free error existed in the block layer
subsystem of the Linux kernel when certain failure conditions occurred. A
local attacker could possibly use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-20856)

Eli Biham and Lior Neumann discovered that the Bluetooth implementation in
the Linux kernel did not properly validate elliptic curve parameters during
Diffie-Hellman key exchange in some situations. An attacker could use this
to expose sensitive information. (CVE-2018-5383)

It was discovered that the Intel Wi-Fi device driver in the Linux kernel did
not properly validate certain Tunneled Direct Link Setup (TDLS). A
physically proximate attacker could use this to cause a denial of service
(Wi-Fi disconnect). (CVE-2019-0136)

It was discovered that a heap buffer overflow existed in the Marvell
Wireless LAN device driver for the Linux kernel. An attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2019-10126)

It was discovered that the Bluetooth UART implementation in the Linux
kernel did not properly check for missing tty operations. A local attacker
could use this to cause a denial of service. (CVE-2019-10207)

Amit Klein and Benny Pinkas discovered that the Linux kernel did not
sufficiently randomize IP ID values generated for connectionless networking
protocols. A remote attacker could use this to track particular Linux
devices. (CVE-2019-10638)

Amit Klein and Benny Pinkas discovered that the location of kernel
addresses could be exposed by the implementation of connection-less network
protocols in the Linux kernel. A remote attacker could possibly use this to
assist in the exploitation of another vulnerability in the Linux kernel.
(CVE-2019-10639)

Adam Zabrocki discovered that the Intel i915 kernel mode graphics driver in
the Linux kernel did not properly restrict mmap() ranges in some
situations. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-11085)

It was discovered that an integer overflow existed in the Linux kernel when
reference counting pages, leading to potential use-after-free issues. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-11487)

Jann Horn discovered that a race condition existed in the Linux kernel when
performing core dumps. A local attacker could use this to cause a denial of
service (system crash) or expose sensitive information. (CVE-2019-11599)

It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash). (CVE-2019-11810)

It was discovered that a race condition leading to a use-after-free existed
in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux
kernel. The RDS protocol is disabled via blocklist by default in Ubuntu.
If enabled, a local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-11815)

It was discovered that the ext4 file system implementation in the Linux
kernel did not properly zero out memory in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2019-11833)

It was discovered that the Bluetooth Human Interface Device Protocol (HIDP)
implementation in the Linux kernel did not properly veri

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS linux-aws-hwe 4.15.0-1047.49~16.04.1
Ubuntu · 18.04 LTS 18.04:LTS linux-aws 4.15.0-1047.49

Vulnerabilities 61

References

  • report
    https://ubuntu.com/security/CVE-2018-5383
  • report
    https://ubuntu.com/security/CVE-2018-13053
  • report
    https://ubuntu.com/security/CVE-2018-13093
  • report
    https://ubuntu.com/security/CVE-2018-13096
  • report
    https://ubuntu.com/security/CVE-2018-13097
  • report
    https://ubuntu.com/security/CVE-2018-13098
  • report
    https://ubuntu.com/security/CVE-2018-13099
  • report
    https://ubuntu.com/security/CVE-2018-13100
  • report
    https://ubuntu.com/security/CVE-2018-14609
  • report
    https://ubuntu.com/security/CVE-2018-14610
  • report
    https://ubuntu.com/security/CVE-2018-14611
  • report
    https://ubuntu.com/security/CVE-2018-14612
  • report
    https://ubuntu.com/security/CVE-2018-14613
  • report
    https://ubuntu.com/security/CVE-2018-14614
  • report
    https://ubuntu.com/security/CVE-2018-14615
  • report
    https://ubuntu.com/security/CVE-2018-14616
  • report
    https://ubuntu.com/security/CVE-2018-14617
  • report
    https://ubuntu.com/security/CVE-2018-16862
  • report
    https://ubuntu.com/security/CVE-2018-19985
  • report
    https://ubuntu.com/security/CVE-2018-20169
  • report
    https://ubuntu.com/security/CVE-2018-20511
  • report
    https://ubuntu.com/security/CVE-2018-20784
  • report
    https://ubuntu.com/security/CVE-2018-20856
  • report
    https://ubuntu.com/security/CVE-2019-0136
  • report
    https://ubuntu.com/security/CVE-2019-2024
  • report
    https://ubuntu.com/security/CVE-2019-2101
  • report
    https://ubuntu.com/security/CVE-2019-3701
  • report
    https://ubuntu.com/security/CVE-2019-3819
  • report
    https://ubuntu.com/security/CVE-2019-3846
  • report
    https://ubuntu.com/security/CVE-2019-3900
  • report
    https://ubuntu.com/security/CVE-2019-9506
  • report
    https://ubuntu.com/security/CVE-2019-10126
  • report
    https://ubuntu.com/security/CVE-2019-10207
  • report
    https://ubuntu.com/security/CVE-2019-10638
  • report
    https://ubuntu.com/security/CVE-2019-10639
  • report
    https://ubuntu.com/security/CVE-2019-11085
  • report
    https://ubuntu.com/security/CVE-2019-11487
  • report
    https://ubuntu.com/security/CVE-2019-11599
  • report
    https://ubuntu.com/security/CVE-2019-11810