2

I ran the AWS Inspector on an EC2 instance that runs Ubuntu 16.04 (kernel 4.16.0), some issues found and i did not manage to fix them even after doing the required actions.

Here are the errors:

Description: The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.

Recommendation: Use your Operating System's update feature to update package linux-image-4.4.0-124-generic-0:4.4.0-124.148. For more information see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7480


Description: In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.

Recommendation: Use your Operating System's update feature to update package cron-0:3.0pl1-128ubuntu2. For more information see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9525


Description: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

Recommendation: Use your Operating System's update feature to update package zlib1g-1:1.2.8.dfsg-2ubuntu4.1, zlib1g-dev-1:1.2.8.dfsg-2ubuntu4.1. For more information see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9841

Tried kernal 4.14 and 4.15 with no luck. Installed the required libs with no luck also.

How can i fix that?

  • Also hitting these. Did you get anywhere? – kaolin Aug 29 '18 at 16:31
0

Upgrading kernel should work, but you have to note that it is looking at all installed kernels, not just the running kernel.

I had good luck with:

AWS-RunShellScript—

#!/bin/bash
package-cleanup --oldkernels --count=1 -y || purge-old-kernels --keep 1 -qy

Possible remediation for cron: upgrading by way of debian package.

dpkg -i http://http.us.debian.org/debian/pool/main/c/cron/cron_3.0pl1-130_amd64.deb
dpkg -i http://http.us.debian.org/debian/pool/main/z/zlib/zlib1g_1.2.11.dfsg-1_amd64.deb

This did not work for another package I was stuck with (man-db), which ... wound up having a rabbit-hole of dependencies... so I'm now looking at upgrading to 18.04LTS (which still hasn't fixed cron, but everything else seems good).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.