by 
Canonical released today an important Linux kernel security update for Ubuntu 19.10 and Ubuntu 18.04.4 LTS releases using the Linux 5.3 kernel series to address a critical vulnerability.
Discovered by Manfred Paul, the security vulnerability (CVE-2020-8835) was found in Linux kernel’s BPF (Berkeley Packet Filter) verifier, which incorrectly calculated register bounds for certain operations.
This could allow a local attacker to either expose sensitive information (kernel memory) or gain administrative privileges and run programs as root user.
The security issue affects all Ubuntu 19.10 (Eoan Ermine) and Ubuntu 18.04.4 LTS (Bionic Beaver) releases running Linux kernel 5.3 on 64-bit, Raspberry Pi, KVM, as well as cloud environments like AWS, Azure, GCP, GKE, and Oracle Cloud.
The vulnerability can be mitigated by setting the kernel.unprivileged_bpf_disabled sysctl option to 1. To do that, you will have to run the following commands in a terminal emulator or the virtual console.
sudo sysctl kernel.unprivileged_bpf_disabled=1 echo kernel.unprivileged_bpf_disabled=1 | \ sudo tee /etc/sysctl.d/90-CVE-2020-8835.conf
However, Canonical urges all Ubuntu 19.10 and Ubuntu 18.04.4 LTS users running the Linux 5.3 kernel packages to update them as soon as possible to the new versions available on the stable software repositories.
After updating the kernel packages, users should reboot their machines for the mitigation to take effect. Thanks to the new kernel lockdown feature, this critical Ubuntu Linux kernel vulnerability is also mitigated on Secure Boot systems.
Canonical also released today a security update for the BlueZ component in Ubuntu 19.10, 18.04 LTS, and 16.04 LTS systems to address two Bluetooth vulnerabilities (CVE-2020-0556 and CVE-2016-7837) that could allow a local attacker to impersonate non-bonded devices or possibly execute arbitrary code.
Last updated 4 years ago
