14 DAY TRIAL // Today, April 6, Canonical has announced the availability of new kernel versions for its Ubuntu 15.10 (Wily Werewolf), Ubuntu 15.10 for Raspberry Pi 2, and Ubuntu 14.04 LTS (Trusty Tahr) operating systems.
Multiple security notices have been published earlier on the Ubuntu website, informing the community about a bunch of new Linux kernel vulnerabilities discovered in the kernel packages for the supported Ubuntu releases mentioned above, which have been patched with today's updates.
A total of six Linux kernel vulnerabilities are mentioned in Canonical's latest security notices, but only four of them affect Ubuntu 14.04 LTS users. The first one is a use-after-free vulnerability discovered by Venkatesh Pottem in Linux kernel's CXGB3 driver, which could have allowed a local attacker to crash the system by causing a denial of service (DoS) or execute code.
The second security flaw is a timing side channel vulnerability discovered by Xiaofei Rex Guo in Linux kernel's EVM (Extended Verification Module) component, which could have allowed an attacker to affect the integrity of the system. The third one, however, is an issue that didn't allow the Linux kernel to enforce limits on the volume of data allocated to buffer pipes, thus allowing a local attacker to cause a DoS attack.
The fourth security issue, which affected both Ubuntu 15.10 and Ubuntu 14.04 LTS, just like the ones mentioned above, was found by David Herrmann. More exactly, it was discovered in the way Linux kernel accounted file descriptors to the original opener for in-flight file descriptors that were sent over a UNIX domain socket, and it could have allowed a local attacker to cause a denial of service (DoS) attack.
Issues affecting only Ubuntu 15.10
The fifth and sixth kernel vulnerabilities mentioned in one of Canonical's security notices affect only the Ubuntu 15.10 and Ubuntu 15.10 for Raspberry Pi 2 operating systems. The first one was discovered by Ralf Spenneberg in Linux kernel's usbvision driver, which incorrectly did sanity checks to the endpoints and interfaces reported by the device, allowing an attacker who had physical access to the system to crash it.
And the second one was discovered in Linux kernel's extended Berkeley Packet Filter (eBPF) implementation, which incorrectly processed branch offsets for backward jumps after a ctx expansion, allowing a local attacker to crash the system via a DoS attack or execute code. Both Ubuntu 15.10 and Ubuntu 14.04 LTS are urged to update their systems immediately to fix these vulnerabilities.
To update, you need to open the Unity Dash, search for the Software Updater utility, open it, wait for it to reload the software repositories and search for new drivers, and then click on the "Install All" button to install them. After a kernel update, you'll need to reboot your computer. The new kernel versions are linux-image-4.2.0-35 (4.2.0-35.40) for Ubuntu 15.10, linux-image-3.13.0-85 (3.13.0-85.129) for Ubuntu 14.04 LTS, and linux-image-4.2.0-1028-raspi2 4.2.0-1028.36 for Ubuntu 15.10 for Raspberry Pi 2.