5

I updated my Ubuntu 14.04 LTS.

My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed.

The changelog page says

linux (3.13.0-134.183) trusty; urgency=low

  • linux: 3.13.0-134.183 -proposed tracker (LP: #1722335)

    [ Thadeu Lima de Souza Cascardo ] * CVE-2017-10661

    • timerfd: Protect the might cancel mechanism proper
  • CVE-2017-10662

    • f2fs: sanity check segment count
  • CVE-2017-10663

    • f2fs: sanity check checkpoint segno and blkoff
  • CVE-2017-14340

    • xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
  • CVE-2017-10911

    • xen-blkback: don't leak stack data via response ring
  • CVE-2017-11176

    • mqueue: fix a use-after-free in sys_mq_notify()
  • CVE-2016-8632

    • tipc: check minimum bearer MTU

    -- Juerg Haefliger Tue, 10 Oct 2017 13:23:11 +0200

This does not look like patch for the Key Reinstallation Attacks.

Should I assume that a patch has not been released yet? Was it released prior to the divulgation of the attacks? Do I wait?

7

The Linux kernel itself is not affected. The part responsible for WPA is wpasupplicant. From the Changelog:

Version: 2.1-0ubuntu1.5 2017-10-16 17:06:43 UTC
wpa (2.1-0ubuntu1.5) trusty-security; urgency=medium

  • SECURITY UPDATE: Multiple issues in WPA protocol
    • debian/patches/2017-1/*.patch: Add patches from Debian jessie
    • CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088
  • 1
    For those not aware, the CVEs listed in this answer match the CVEs listed in the CERT database for the "Krack" vulnerability. – Todd Wilcox Oct 17 '17 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.