Ubuntu security update for ubuntu-xenial-aws and ubuntu-trusty-lts-xenial

[Irina Semenova]

To apply patches do the following: 

Systems with AUTO_UPDATE=True (DEFAULT) in /etc/sysconfig/kcare/kcare.conf will automatically update, and no action is needed for them.

You can manually update the server by running:

# /usr/bin/kcarectl --update

CHANGELOG:

ubuntu-trusty-lts-xenial:

  CVE-2018-5390: A flaw named SegmentSmack was found in the way the Linux kernel handled

    specially crafted TCP packets. A remote attacker could use this flaw to trigger

    time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue()

    functions by sending specially modified packets within ongoing TCP sessions which

    could lead to a CPU saturation and hence a denial of service on the system. Maintaining

    the denial of service condition requires continuous two-way TCP sessions to a

    reachable open port, thus the attacks cannot be performed using spoofed IP addresses.

  cvelist: [CVE-2018-5390]

  latest-version: 4.4.0-131.157~14.04.1

ubuntu-xenial:

  CVE-2018-5390: A flaw named SegmentSmack was found in the way the Linux kernel handled

    specially crafted TCP packets. A remote attacker could use this flaw to trigger

    time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue()

    functions by sending specially modified packets within ongoing TCP sessions which

    could lead to a CPU saturation and hence a denial of service on the system. Maintaining

    the denial of service condition requires continuous two-way TCP sessions to a

    reachable open port, thus the attacks cannot be performed using spoofed IP addresses.

  cvelist: [CVE-2018-5390]

  latest-version: 4.4.0-131.157

ubuntu-xenial-aws:

  CVE-2018-5390: A flaw named SegmentSmack was found in the way the Linux kernel handled

    specially crafted TCP packets. A remote attacker could use this flaw to trigger

    time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue()

    functions by sending specially modified packets within ongoing TCP sessions which

    could lead to a CPU saturation and hence a denial of service on the system. Maintaining

    the denial of service condition requires continuous two-way TCP sessions to a

    reachable open port, thus the attacks cannot be performed using spoofed IP addresses.

  cvelist: [CVE-2018-5390]

  latest-version: 4.4.0-1062.71

--

-- 

Regards, 

Irina Semenova | Project Coordinator of KernelCare 

Skype: iras535

CloudLinux.com  |  KernelCare.com  |  Imunify360 

helpdesk.cloudlinux.com: 24/7 Free, exceptionally good support
Follow twitter.com/CloudLinuxOS for technical updates