6

I have a request from my network security colleague to investigate the threat of this CVE for our environment and I'm having a hard time figuring it out. When I look on the CVE tracker for that CVE: https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5696.html

It lists the package versions as well as the release versions. Which confuses me. Like it seems to imply that you can run the Trusty source on the Precise OS?

But that's besides the point. Our environment is predominantly Precise servers with a handful of Trusty servers and I need to know if this vulnerability applies to me. Is there a command I can run to determine if I'm using one of these packages that is listed. The package names actually specified in the tracker like "linux-lts-trusty" are not apt-get packages so "apt-cache show" doesn't help.

4

First of all, the package that it refers to linux-lts-trusty refers to the kernels images. They are named differently in the repositories. If you do apt-cache search linux-.* | grep 'trusty' you will find packages like linux-image-virtual-lts-trusty or linux-image-virtual-lts-wily. In addition , if you open the launchpad link, git.kernel.org link and others from the CVE report you have there all point that this is Linux kernel vulnerability.

So, for linux-lts-trusty, for which Launchpad latest version at the time of me writing this is 3.13.0-93.140-precise1 lists that only for Ubuntu 12.04 fix is needed, for other versions bug DNE(does not exist):

enter image description here

For linux-lts-wily , which is version 4.2.0-42.49-14.04.1 , only trusty (14.04 ) is at risk. enter image description here

So it really depends on the kernel version you are running. Of course, the best approach would be that your server is upgraded to the latest version, 16.04 LTS , and have newer kernel versions. You didn't provide us with your kernel version so we don't know if you are at risk for this or not.

It lists the package versions as well as the release versions. Which confuses me. Like it seems to imply that you can run the Trusty source on the Precise OS?

Technically you can run older kernel on newer OS version and vice versa, so yes, that is correct.

NOTES:

  • Wily Werewolf (15.10) has already reached End of Life and no longer supported. If you are running this version, I strongly suggest you upgrade.

  • linux-lts-saucy kernel version appears that it doesn't have that vulnerability . That's version 3.11.0-26.45-precise1 . I would suggest any 3.11.x version, but this is still not ideal ; newer versions are preferable.

  • Tracking linux in the tracker for this CVE for a given release will track the base kernel shipped in that release. Tracking linux-lts-* in the tracker for this CVE will track an HWE kernel, available only in LTS editions which get HWE updates. Until all of them are "released" or "fixed", for all Source packages and all relevant distributions on the Tracker, you are not going to be able to 'avoid' the CVE.

  • Just to add, this specific CVE has not been fixed in any releases yet, so upgrading to 16.04 won't help in this case. – gQuigs Aug 11 '16 at 14:07
  • @Serg CentOS 5 is affected by this vulnerability ? – Naive Aug 12 '16 at 9:45
  • I think you've misunderstood the Ubuntu Security website page for that CVE (people.canonical.com/~ubuntu-security/cve/2016/…). It's saying that ALL current Ubuntu versions except Ubuntu Touch 15.04 are vulnerable (see the table for the 'linux' package, which is what the kernel packages are generated from). The other tables for linux-lts-XX are for special kernels, e.g. for the LTS Enablement Stack. These tables say 'DNE' for most versions of Ubuntu because these kernels are specific to only one version, not because those versions of Ubuntu aren't vulernable. – happyskeptic Aug 16 '16 at 7:02
  • @happyskeptic It is possible to install various kernels, even if they carry name of different release. Hence, per version tables. As for ALL current releases, how would you explain linux-lts-xenial table also saying Ubuntu 16.04 LTS (Xenial Xerus): DNE – Sergiy Kolodyazhnyy Aug 16 '16 at 9:02
  • As I wrote, you've completely misunderstood those tables. The kernel linux-lts-xenail is not available on 16.04 (Xenial). This kernel is only available as an LTS Enablement kernel for 14.04, which is why it's marked as only needing a fix on 14.04. The basic misunderstanding is you think that 'DNE' always means the bug isn't present in that version. But it actually can also mean that the package isn't present in that Ubuntu version, and therefore no fix needs to be made. – happyskeptic Aug 16 '16 at 22:06
1

Please note that https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5696.html does not make it clear which kernel Xenial (16.04LTS) uses. According to xenial-updates this is currently 4.4.0.34.36 which is vulnerable for CVE-2016-5696.

https://people.canonical.com/~ubuntu-security/cve/pkg/linux.html shows this as well.

  • Correct, Xenial (16.04) is vulnerable currently - until Ubuntu release patched kernels for it, which should be by 27 August. The relevant kernel to look at on that page is 'linux', this is the source package from which all normal (i.e. not specialised LTS Enablement kernels or other once-offs) kernel packages are built. – happyskeptic Aug 16 '16 at 7:13
  • It's well possible to switch to other kernel version not affected by this CVE. – Sergiy Kolodyazhnyy Aug 16 '16 at 9:10
  • No it isn't. If you're on, for example, 14.04, the only more recent kernel is the LTS Enablement linux-lts-xenial which is affected by the bug. Same if you're on Xenial - there is no more recent kernel. If you're on 12.04 your LTS Enablement kernel is linux-lts-trusty, which is affected. The only current way to switch to a kernel version not affected is to use the -proposed repo (as suggested by Trent Lloyd), which already contains the fixed kernel that'll be released by 27 Aug. – happyskeptic Aug 16 '16 at 22:03
1

As of today (16 August 2016) ALL current versions of Ubuntu apart from Ubuntu Touch 15.04 are vulnerable: enter image description here

The relevant info from Ubuntu is here, they plan on releasing patched kernels by 27 August: https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5696.html

As explained in my comment to Serg's answer above, the important package to look at is 'linux', which is the source package for the kernels in each release. The other packages are mostly LTS Enablement kernels or other specialised kernels, all of which are specific to particular versions.

For example linux-lts-quantal is listed as 'DNE' for all versions except 12.04 (which is anyway end-of-life). However this doesn't mean that those versions are not affected by the issue, the 'DNE' is there because the package linux-lts-quantal was only ever specific to 12.04 and doesn't apply to any other version.

  • You could patch now by using the -proposed repository, with the obvious downside that the packages are not yet well tested. – Trent Lloyd Aug 16 '16 at 9:06
  • The linux package that you're refering to points to a list of 4.4.0 modules and 4.4 kernel. That only means all ubuntu versions with that kernel version are affected. – Sergiy Kolodyazhnyy Aug 16 '16 at 9:08
  • Sorry, but that's again completely wrong. Click on the LP (Launchpad) link for the 'linux' kernel and then scroll down - you'll see that 4.4.0-21 is just the most current released version - the original kernel (before updates) from 16.04 Xenail. If you scroll further down the list you'll see it then lists all the various versions from current releases - 4.6.0 for upcoming 16.10, 4.2 for Wily and so on. – happyskeptic Aug 16 '16 at 21:59
  • The 'Ubuntu' link (to the packages.ubuntu.com website) above the table shows it even clearer - it lists the various kernel packages that have 'linux' as a source: packages.ubuntu.com/… – happyskeptic Aug 16 '16 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.