Ubuntu update for linux



Risk High
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2020-0423
CVE-2020-10135
CVE-2020-25656
CVE-2020-25668
CVE-2020-25705
CVE-2020-27675
CVE-2020-27777
CVE-2020-28974
CWE-ID CWE-20
CWE-300
CWE-416
CWE-330
CWE-476
CWE-862
CWE-125
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #5 is available.
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

linux-image-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1103-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gke (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws-hwe (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-129-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-129-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-129-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1091-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1091-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1062-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-snapdragon (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-raspi2 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oracle-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gke-4.15 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gcp-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-azure-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1094-snapdragon (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1082-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1077-raspi2 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1077-gke (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU47453

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2020-0423

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Binder component in OS kernel. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary code on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU28001

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10135

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a Man-in-the-Middle (MitM) attack.

The vulnerability exists in the implementation of Bluetooth v5.0, v4.2, v4.1, v4.0 on devices manufactured by multiple vendors. A remote attacker with physical proximity to the victim can successful perform a MitM attack even against previously paired devices and gain access to sensitive information.

Below is the list of chips and devices, confirmed to be vulnerable:

Chip Device
Bluetooth v5.0
Apple 339S00397 iPhone 8
CYW20819 CYW920819EVB-02
Intel 9560 ThinkPad L390
Snapdragon 630 Nokia 7
Snapdragon 636 Nokia X6
Snapdragon 835 Pixel 2
Snapdragon 845 Pixel 3, OnePlus 6
Bluetooth v4.2
Apple 339S00056 MacBookPro 2017
Apple 339S00199 iPhone 7plus
Apple 339S00448 iPad 2018
CSR 11393 Sennheiser PXC 550
Exynos 7570 Galaxy J3 2017
Intel 7265 ThinkPad X1 3rd
Intel 8260 HP ProBook 430 G3
Bluetooth v4.1
CYW4334 iPhone 5s
CYW4339 Nexus 5, iPhone 6
CYW43438 RPi 3B+
Snapdragon 210 LG K4
Snapdragon 410 Motorola G3, Galaxy J5
Bluetooth <= v4.0
BCM20730 ThinkPad 41U5008
BCM4329B1 iPad MC349LL
CSR 6530 PLT BB903+
CSR 8648 Philips SHB7250
Exynos 3470 Galaxy S5 mini
Exynos 3475 Galaxy J3 2016
Intel 1280 Lenovo U430
Intel 6205 ThinkPad X230
Snapdragon 200 Lumia 530

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU51547

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25656

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in the way the console subsystem uses KDGKBSENT and KDSKBSENT IOCTLs. A local user can run a specially crafted program to trigger an out-of-bounds read and gain access to sensitive information.


Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU83431

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25668

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local authenticated user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the con_font_op. A local authenticated user can trigger a use-after-free error and escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use of insufficiently random values

EUVDB-ID: #VU49150

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-25705

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) NULL pointer dereference

EUVDB-ID: #VU83584

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-27675

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in drivers/xen/events/events_base.c. A malicious guest can trigger a dom0 crash by sending events for a paravirtualized device while simultaneously performing its reconfiguration.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Missing Authorization

EUVDB-ID: #VU56242

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-27777

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way RTAS handles memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like user could use this flaw to further increase their privileges to that of a running kernel.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU90369

Risk: Medium

CVSSv4.0: 1.8 [CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-28974

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local privileged user to read and manipulate data.

The vulnerability exists due to an out-of-bounds read error within the con_font_default() and con_font_op() functions in drivers/tty/vt/vt.c. A local privileged user can read and manipulate data.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-azure (Ubuntu package): before 4.15.0.1103.78

linux-image-4.15.0-1103-azure (Ubuntu package): before 4.15.0-1103.114~14.04.1

linux-image-virtual-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-oracle (Ubuntu package): before 4.15.0.1062.51

linux-image-oem (Ubuntu package): before 4.15.0.129.128

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gke (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-generic-hwe-16.04 (Ubuntu package): before 4.15.0.129.128

linux-image-gcp (Ubuntu package): before 4.15.0.1091.92

linux-image-aws-hwe (Ubuntu package): before 4.15.0.1091.85

linux-image-4.15.0-129-lowlatency (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic-lpae (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-129-generic (Ubuntu package): before 4.15.0-129.132~16.04.1

linux-image-4.15.0-1091-gcp (Ubuntu package): before 4.15.0-1091.104~16.04.1

linux-image-4.15.0-1091-aws (Ubuntu package): before 4.15.0-1091.96~16.04.1

linux-image-4.15.0-1062-oracle (Ubuntu package): before 4.15.0-1062.68~16.04.1

linux-image-virtual (Ubuntu package): before 4.15.0.129.116

linux-image-snapdragon (Ubuntu package): before 4.15.0.1094.97

linux-image-raspi2 (Ubuntu package): before 4.15.0.1077.74

linux-image-oracle-lts-18.04 (Ubuntu package): before 4.15.0.1062.72

linux-image-lowlatency (Ubuntu package): before 4.15.0.129.116

linux-image-kvm (Ubuntu package): before 4.15.0.1082.78

linux-image-gke-4.15 (Ubuntu package): before 4.15.0.1077.81

linux-image-generic-lpae (Ubuntu package): before 4.15.0.129.116

linux-image-generic (Ubuntu package): before 4.15.0.129.116

linux-image-gcp-lts-18.04 (Ubuntu package): before 4.15.0.1091.109

linux-image-azure-lts-18.04 (Ubuntu package): before 4.15.0.1103.76

linux-image-aws-lts-18.04 (Ubuntu package): before 4.15.0.1091.93

linux-image-4.15.0-1094-snapdragon (Ubuntu package): before 4.15.0-1094.103

linux-image-4.15.0-1082-kvm (Ubuntu package): before 4.15.0-1082.84

linux-image-4.15.0-1077-raspi2 (Ubuntu package): before 4.15.0-1077.82

linux-image-4.15.0-1077-gke (Ubuntu package): before 4.15.0-1077.82

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4680-1


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###