Ubuntu 16.04 — linux-euclid — multiple vulnerabilities (8 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: Ubuntu Security Notice USN-3641-1

Related CVEs: CVE-2018-1000199 CVE-2018-1087 CVE-2018-8897 CVE-2017-16995 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown

Upstream summary: Nick Peterson discovered that the Linux kernel did not
properly handle debug exceptions following a MOV/POP to SS
instruction. A local attacker could use this to cause a denial
of service (system crash). This issue only affected the amd64
architecture. (CVE-2018-8897)

Andy Lutomirski discovered that the KVM subsystem of the Linux kernel
did not properly emulate the ICEBP instruction following a MOV/POP
to SS instruction. A local attacker in a KVM virtual machine could
use th

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

A flaw in linux-euclid sits underneath every process on the host: local privilege escalation to root, container escape from an unprivileged namespace, memory corruption reachable from a crafted packet, or — in microcode, firmware and bootloader components — a weakness below Ubuntu 16.04 entirely. The update only stages files on disk: kernel and initramfs in /boot, blobs under /lib/firmware. The vulnerable code stays resident until the host boots it, which is why a package-database scan calls a host patched while it still runs the flaw. linux-euclid is boot-time code — kernel, modules, device firmware, microcode or bootloader — not a service, so there is no unit to restart; only a reboot (or a livepatch, where one applies) loads the new build.

Environment & Reproduction

Reproduction targets Ubuntu 16.04 (xenial). Confirm release and installed package:

lsb_release -a
cat /etc/os-release
dpkg -l linux-euclid | tail -2
apt-cache policy linux-euclid
uname -r

Exercise the workload that uses linux-euclid while collecting:

[ -f /var/run/reboot-required ] && cat /var/run/reboot-required  # Ubuntu (pkg: update-notifier-common). /run/reboot-required is the real path; /var/run is a compat symlink
sort -u /var/run/reboot-required.pkgs 2>/dev/null  # exactly which packages asked for the reboot -- often only a kernel or dbus, not your service
sudo journalctl -xe --no-pager | tail -200
sudo tail -200 /var/log/apt/history.log
sudo tail -200 /var/log/kern.log | grep -i apparmor

Root Cause Analysis

Root cause is documented in Ubuntu Security Notice USN-3641-1. Canonical security maintainers shipped fixes in the corresponding linux-euclid update for Ubuntu 16.04; running an outdated build leaves the host exposed to the failure modes described in the advisory. On this release the fix typically arrives via the Ubuntu Pro ESM (esm-infra / esm-apps) channels rather than the standard archive. Correlate apt history with the journal:

grep -A2 -B2 linux-euclid /var/log/apt/history.log
zgrep -A2 -B2 linux-euclid /var/log/apt/history.log.*.gz 2>/dev/null
cat /proc/sys/kernel/tainted   # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on Ubuntu 16.04 to capture the current state of linux-euclid:

dpkg -l linux-euclid | tail -1                  # installed version
dpkg -V linux-euclid                             # verify shipped files
sudo apt update && apt list --upgradable 2>/dev/null | grep -i security
sudo ufw status verbose 2>/dev/null | head -20
sudo aa-status 2>/dev/null | head -20
# If linux-euclid ships a service unit (unit/job name often differs from pkg name, e.g.
# bind9→named, apache2→apache2, postgresql-NN→postgresql@NN-main):
dpkg-query -L linux-euclid 2>/dev/null | grep -E '^/etc/init\.d/[^/]+$'  # legacy SysV init script; its basename is the service name for 'service <name> restart' on non-systemd hosts
systemctl list-unit-files --no-pager --type=service,socket,timer | grep -iF -- 'linux-euclid'  # fuzzy name match; -F is required because package names contain regex metacharacters ('+' in libstdc++6/g++-13 makes -E fail to match at all)

On xenial the standard archive no longer ships security fixes. Verify Ubuntu Pro ESM coverage:

# `pro` CLI not available on this release; check the older `ubuntu-advantage-tools`:
sudo ua status --format=json 2>/dev/null | head
apt-cache policy | grep -i esm

Step-by-Step Diagnosis

1. List failing services.

   systemctl --failed --no-pager

2. Tail the journal / syslog for linux-euclid.

   sudo journalctl -xe -f --no-pager

3. Inspect UFW (Uncomplicated Firewall) state.

   sudo ufw status numbered
   sudo ufw show added
   sudo iptables -L -n -v | head -30

4. Surface AppArmor denials and switch the profile to complain mode if needed.

   sudo journalctl -k 2>/dev/null | grep -i 'apparmor="DENIED"' | tail -30
   sudo aa-status
   # /etc/apparmor.d/usr.bin.linux-euclid or usr.sbin.linux-euclid — inspect first
   sudo aa-complain /etc/apparmor.d/usr.bin.linux-euclid 2>/dev/null || true

5. Verify linux-euclid integrity and reinstall if anything is altered.

   sudo dpkg -V linux-euclid
   sudo debsums -c linux-euclid 2>/dev/null
   sudo apt install --reinstall -y linux-euclid

6. Correlate findings with /var/log/apt/history.log, /var/log/dpkg.log, and Ubuntu Security Notice USN-3641-1 to pin the change that introduced the regression.

Solution – Primary Fix

Apply the corrective apt transaction referenced by Ubuntu Security Notice USN-3641-1, then reload the affected service:

sudo apt update
sudo apt -y install --only-upgrade linux-euclid
# Service name may differ from pkg name; check first:
dpkg -l linux-euclid | tail -1            # confirm new version

On xenial the standard archive is past EoL for security; enable Ubuntu Pro ESM to receive the fix:

# Older releases use the `ua` command:
sudo ua attach <token>
sudo ua enable esm-infra
sudo ua enable esm-apps
sudo apt update
sudo apt -y install --only-upgrade linux-euclid

For kernel / glibc / systemd / openssl advisories a reboot (or Livepatch) is required:

sudo apt install -y needrestart
sudo needrestart -r l       # list units that need restart
sudo systemctl reboot       # or: sudo shutdown -r now

Solution – Alternative Approaches

If the primary upgrade is not viable, pick from these:

• Hold the package so apt cannot upgrade it:

  sudo apt-mark hold linux-euclid
  apt-mark showhold | grep linux-euclid
  # Release the hold later with:
  sudo apt-mark unhold linux-euclid

• Pin a known-good version via apt preferences:

  # /etc/apt/preferences.d/linux-euclid.pref
  Package: linux-euclid
  Pin: version <good-version>
  Pin-Priority: 1001

• Downgrade to an older version if a regression is suspected:

  apt-cache madison linux-euclid
  sudo apt install --allow-downgrades -y linux-euclid=<older-version>

• Investigate AppArmor blocking the new binary; switch to complain briefly, capture denials, then re-enforce:

  sudo aa-complain /etc/apparmor.d/usr.bin.linux-euclid 2>/dev/null
  # reproduce the failure
  sudo journalctl -k | grep apparmor | tail
  sudo aa-enforce /etc/apparmor.d/usr.bin.linux-euclid 2>/dev/null

• Take only the security pocket update and defer the full point-release upgrade:

  sudo apt -y install --only-upgrade -t xenial-security linux-euclid

Verification & Acceptance Criteria

All of these should pass after the fix is applied:

dpkg -l linux-euclid | tail -1                                  # expected fixed version
apt list --upgradable 2>/dev/null | grep -i security || echo OK
sudo ufw status numbered | head
sudo aa-status 2>/dev/null | head -5

The conditions described in the advisory must no longer be reported for linux-euclid across two consecutive runs.

Rollback Plan

Capture state before any change:

apt list --installed 2>/dev/null > /root/apt-pre.txt
dpkg --get-selections > /root/dpkg-pre.txt
# ZFS-on-root (Ubuntu 20.04+ default installer option):
sudo zfs snapshot rpool/ROOT/ubuntu@pre-linux-euclid
# LVM-on-root:
sudo lvcreate -L 4G -s -n root_pre_patch /dev/<vg>/<root-lv>

To revert:

sudo apt install --allow-downgrades -y linux-euclid=<old-version>
# Kernel rollback: pick the prior kernel from the GRUB menu, then:
sudo systemctl reboot
# ZFS rollback (rolls the whole root dataset):
sudo zfs rollback -r rpool/ROOT/ubuntu@pre-linux-euclid

Prevention & Hardening

Reduce the chance of this recurring on Ubuntu 16.04 (xenial):

• Enable scheduled security updates via unattended-upgrades:

  sudo apt install -y unattended-upgrades update-notifier-common
  sudo dpkg-reconfigure -plow unattended-upgrades
  # /etc/apt/apt.conf.d/50unattended-upgrades:
  Unattended-Upgrade::Allowed-Origins { "${distro_id}:${distro_codename}-security"; };

• Install needrestart so services restart automatically after library upgrades:

  sudo apt install -y needrestart
  # /etc/needrestart/needrestart.conf -> $nrconf{restart} = 'a';

• Attach Ubuntu Pro for ESM (mandatory on this past-EoL release) and Livepatch where supported:

  sudo ua attach <token>
  sudo ua enable esm-infra
  sudo ua enable esm-apps

• Subscribe to ubuntu-security-announce and watch ubuntu.com/security/cves.

• Monitor file integrity with debsums and AIDE:

  sudo apt install -y debsums aide
  sudo debsums -ca
  sudo aideinit && sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
  sudo aide --check

• For estate-wide patching, manage with Canonical Landscape:

  sudo apt install -y landscape-client
  sudo landscape-config

• Keep AppArmor profiles in enforce mode and apply CIS Ubuntu Linux Benchmark hardening.

Related Errors & Cross-Refs

Issues that commonly surface alongside a linux-euclid update: apt lock contention, broken dpkg state, systemd ordering cycles, AppArmor denials, and UFW rule drift. Useful triage:

sudo dpkg --configure -a
sudo apt --fix-broken install
systemd-analyze critical-chain
sudo journalctl -k 2>/dev/null | grep -i apparmor | tail
cat /proc/sys/kernel/tainted

View all ubuntu-16-04 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: Ubuntu Security Notice USN-3641-1. Manual pages useful on Ubuntu 16.04:

man apt
man apt-get
man apt-mark
man dpkg
man systemctl
man journalctl
man ufw
man apparmor
man aa-status
man unattended-upgrades
man ua

Other resources: Ubuntu Security Notices, Ubuntu CVE Tracker, Ubuntu upgrade notes, and per-package notes in /usr/share/doc/linux-euclid/ for components implicated in this advisory.