Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2018-1108

Published: 21 May 2018

kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.

From the Ubuntu Security Team

Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive information.

Notes

AuthorNote
sbeattie
not clear if RNDRESEEDCRNG ioctl should be backported, too;
it's unlikely user space will receive backports to support it.
fix introduced regression bug LP: #1779827

Priority

Medium

Cvss 3 Severity Score

5.9

Score breakdown

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-33.36)
upstream
Released (4.17~rc2)
artful Ignored
(end of life)
cosmic Not vulnerable
(4.17.0-6.7)
trusty Not vulnerable

xenial Not vulnerable

Patches:
Introduced by

e192be9d9a30555aae2ca1dc3aad37cba484cd4a

Fixed by 43838a23a05fbd13e47d750d3dfd77001536dd33
Introduced by

ee7998c50c2697737c6530431709f77c852bf0d6

Fixed by dc12baacb95f205948f64dc936a47d89ee110117
Introduced by

1e7f583af67be4ff091d0aeb863c649efd7a9112

Fixed by 8ef35c866f8862df074a49a93b0309725812dea8
linux-aws
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1020.20)
upstream
Released (4.17~rc2)
artful Does not exist

cosmic Not vulnerable
(4.15.0-1020.20)
trusty Not vulnerable

xenial Not vulnerable

linux-azure
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1022.23)
upstream
Released (4.17~rc2)
artful Does not exist

cosmic Not vulnerable
(4.18.0-1003.3)
trusty Not vulnerable
(4.15.0-1023.24~14.04.1)
xenial
Released (4.15.0-1022.22~16.04.1)
linux-azure-edge
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(4.18.0-1003.3~18.04.1)
upstream
Released (4.17~rc2)
cosmic Does not exist

trusty Does not exist

xenial
Released (4.15.0-1022.23)
linux-euclid
Launchpad, Ubuntu, Debian
bionic Does not exist

upstream
Released (4.17~rc2)
artful Does not exist

cosmic Does not exist

trusty Does not exist

xenial Not vulnerable

linux-flo
Launchpad, Ubuntu, Debian
bionic Does not exist

upstream
Released (4.17~rc2)
artful Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [abandoned])
xenial Ignored
(abandoned)
linux-gcp
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1018.19)
upstream
Released (4.17~rc2)
artful Does not exist

cosmic Not vulnerable
(4.15.0-1018.19)
trusty Does not exist

xenial
Released (4.15.0-1018.19~16.04.2)
linux-gke
Launchpad, Ubuntu, Debian
bionic Does not exist

upstream
Released (4.17~rc2)
artful Does not exist

cosmic Does not exist

trusty Does not exist

xenial Ignored
(end of standard support, was needs-triage)
linux-goldfish
Launchpad, Ubuntu, Debian
bionic Does not exist

upstream
Released (4.17~rc2)
artful Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [abandoned])
xenial Ignored
(end of life, was needs-triage)
linux-grouper
Launchpad, Ubuntu, Debian
bionic Does not exist

artful Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [abandoned])
xenial Does not exist

upstream
Released (4.17~rc2)
linux-hwe
Launchpad, Ubuntu, Debian
bionic Not vulnerable

artful Does not exist

cosmic Does not exist

trusty Does not exist

upstream
Released (4.17~rc2)
xenial
Released (4.15.0-33.36~16.04.1)
linux-lts-trusty
Launchpad, Ubuntu, Debian
artful Does not exist

cosmic Does not exist

trusty Does not exist

xenial Does not exist

bionic Does not exist

upstream
Released (4.17~rc2)
linux-lts-utopic
Launchpad, Ubuntu, Debian
artful Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [end of standard support])
xenial Does not exist

bionic Does not exist

upstream
Released (4.17~rc2)
linux-lts-vivid
Launchpad, Ubuntu, Debian
artful Does not exist

cosmic Does not exist

xenial Does not exist

bionic Does not exist

trusty Does not exist
(trusty was ignored [end of standard support])
upstream
Released (4.17~rc2)
linux-hwe-edge
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Not vulnerable
(4.18.0-11.12~18.04.1)
cosmic Does not exist

trusty Does not exist

upstream
Released (4.17~rc2)
xenial
Released (4.15.0-33.36~16.04.1)
linux-kvm
Launchpad, Ubuntu, Debian
artful Does not exist

bionic
Released (4.15.0-1020.20)
cosmic Not vulnerable
(4.15.0-1020.20)
trusty Does not exist

upstream
Released (4.17~rc2)
xenial Not vulnerable

linux-lts-wily
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [end of standard support])
upstream
Released (4.17~rc2)
xenial Does not exist

linux-lts-xenial
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

trusty Not vulnerable

upstream
Released (4.17~rc2)
xenial Does not exist

linux-maguro
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [abandoned])
upstream
Released (4.17~rc2)
xenial Does not exist

linux-mako
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [abandoned])
upstream
Released (4.17~rc2)
xenial Ignored
(abandoned)
linux-manta
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

trusty Does not exist
(trusty was ignored [abandoned])
upstream
Released (4.17~rc2)
xenial Does not exist

linux-oem
Launchpad, Ubuntu, Debian
artful Does not exist

bionic
Released (4.15.0-1017.20)
cosmic Not vulnerable
(4.15.0-1017.20)
trusty Does not exist

upstream
Released (4.17~rc2)
xenial Ignored
(end of standard support, was needed)
linux-raspi2
Launchpad, Ubuntu, Debian
artful Ignored
(end of life)
bionic
Released (4.15.0-1021.23)
cosmic Not vulnerable
(4.15.0-1021.23)
trusty Does not exist

upstream
Released (4.17~rc2)
xenial Not vulnerable

linux-snapdragon
Launchpad, Ubuntu, Debian
artful Not vulnerable

bionic Not vulnerable

cosmic Does not exist

trusty Does not exist

upstream
Released (4.17~rc2)
xenial Not vulnerable

Severity score breakdown

Parameter Value
Base score 5.9
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N