Your submission was sent successfully! Close

CVE-2019-10639

Published: 5 July 2019

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.

From the Ubuntu Security Team

Amit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-60.67)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-16.17)
eoan Not vulnerable
(5.0.0-16.17)
precise Ignored
(was needs-triage ESM criteria)
trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (5.1~rc4)
xenial
Released (4.4.0-150.176)
Patches:
Introduced by

0b4419162aa6c4204843f3a13b48d9ab821d3167

Fixed by 355b98553789b646ed97ad801a619ff898471b92
linux-aws
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1047.49)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-1007.7)
eoan Not vulnerable
(5.0.0-1007.7)
precise Does not exist

trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (5.1~rc4)
xenial
Released (4.4.0-1084.94)
linux-aws-5.0
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1021.24~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-aws-hwe
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.15.0-1047.49~16.04.1)
linux-azure
Launchpad, Ubuntu, Debian
bionic
Released (5.0.0-1014.14~18.04.1)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-1008.8)
eoan Not vulnerable
(5.0.0-1008.8)
precise Does not exist

trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (5.1~rc4)
xenial
Released (4.15.0-1056.61)
linux-azure-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1007.8~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-azure-edge
Launchpad, Ubuntu, Debian
bionic
Released (5.0.0-1014.14~18.04.1)
cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.15.0-1056.61)
linux-euclid
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Ignored
(was needs-triage now end-of-life)
linux-flo
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Ignored
(abandoned)
linux-gcp
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1042.45)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-1007.7)
eoan Not vulnerable
(5.0.0-1007.7)
precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.15.0-1041.43)
linux-gcp-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1008.9~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-gcp-edge
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1042.45)
cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-gke
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Ignored
(end-of-life)
linux-gke-4.15
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1041.43)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-gke-5.0
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1011.11~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-goldfish
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Ignored
(end-of-life)
linux-grouper
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-hwe
Launchpad, Ubuntu, Debian
bionic
Released (5.0.0-23.24~18.04.1)
cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.15.0-60.67~16.04.1)
linux-hwe-edge
Launchpad, Ubuntu, Debian
bionic
Released (5.0.0-16.17~18.04.1)
cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.15.0-60.67~16.04.1)
linux-kvm
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1043.43)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-1007.7)
eoan Not vulnerable
(5.0.0-1007.7)
precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.4.0-1047.53)
linux-lts-trusty
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Ignored
(was needs-triage ESM criteria)
trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-lts-utopic
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-lts-vivid
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-lts-wily
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-lts-xenial
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Ignored
(was needs-triage ESM criteria)
upstream
Released (5.1~rc4)
xenial Does not exist

linux-maguro
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-mako
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Ignored
(abandoned)
linux-manta
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-oem
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1056.65)
cosmic Ignored
(reached end-of-life)
disco Ignored
(was pending \[4.15.0-1056.65\] now end-of-life)
eoan
Released (4.15.0-1059.68)
precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Ignored
(was needs-triage now end-of-life)
linux-oem-5.4
Launchpad, Ubuntu, Debian
bionic Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-oem-osp1
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1010.11)
disco Not vulnerable
(5.0.0-1010.11)
eoan Not vulnerable
(5.0.0-1010.11)
precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-oracle
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1022.25)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-1004.8)
eoan Not vulnerable
(5.3.0-1002.2)
precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.15.0-1022.25~16.04.1)
linux-oracle-5.0
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.0.0-1007.12~18.04.1)
disco Does not exist

eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-raspi2
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1044.47)
cosmic Ignored
(reached end-of-life)
disco
Released (5.0.0-1009.9)
eoan Not vulnerable
(5.0.0-1009.9)
precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.4.0-1110.118)
linux-raspi2-5.3
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(5.3.0-1017.19~18.04.1)
eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial Does not exist

linux-snapdragon
Launchpad, Ubuntu, Debian
bionic
Released (4.15.0-1062.69)
cosmic Does not exist

disco
Released (5.0.0-1013.13)
eoan Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (5.1~rc4)
xenial
Released (4.4.0-1114.119)