5

I updated my Ubuntu 14.04 LTS.

My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed.

The changelog page says

linux (3.13.0-134.183) trusty; urgency=low

  • linux: 3.13.0-134.183 -proposed tracker (LP: #1722335)

    [ Thadeu Lima de Souza Cascardo ] * CVE-2017-10661

    • timerfd: Protect the might cancel mechanism proper

  • CVE-2017-10662

    • f2fs: sanity check segment count

  • CVE-2017-10663

    • f2fs: sanity check checkpoint segno and blkoff

  • CVE-2017-14340

    • xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present

  • CVE-2017-10911

    • xen-blkback: don't leak stack data via response ring

  • CVE-2017-11176

    • mqueue: fix a use-after-free in sys_mq_notify()

  • CVE-2016-8632

    • tipc: check minimum bearer MTU

    -- Juerg Haefliger Tue, 10 Oct 2017 13:23:11 +0200

This does not look like patch for the Key Reinstallation Attacks.

Should I assume that a patch has not been released yet? Was it released prior to the divulgation of the attacks? Do I wait?

Improve this question

1 Answer 1

Reset to default
7

The Linux kernel itself is not affected. The part responsible for WPA is wpasupplicant. From the Changelog:

Version: 2.1-0ubuntu1.5 2017-10-16 17:06:43 UTC
wpa (2.1-0ubuntu1.5) trusty-security; urgency=medium

  • SECURITY UPDATE: Multiple issues in WPA protocol
    • debian/patches/2017-1/*.patch: Add patches from Debian jessie
    • CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088
Improve this answer
1
  • 1
    For those not aware, the CVEs listed in this answer match the CVEs listed in the CERT database for the "Krack" vulnerability.
    – Todd Wilcox
    Commented Oct 17, 2017 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .