SB2021041394 - Ubuntu update for linux-oem-5.6
Published: April 13, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Command Injection (CVE-ID: CVE-2021-29154)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect computation of branch displacements within the BPF JIT compilers in the Linux kernel in arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. A local user can inject and execute arbitrary commands with elevated privileges.
2) Input validation error (CVE-ID: CVE-2020-0423)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input within the Binder component in OS kernel. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary code on the system.
3) Out-of-bounds write (CVE-ID: CVE-2020-0465)
The vulnerability allows an attacker with physical access to escalate privileges on the system.
The vulnerability exists due to an out of bounds write in various methods of hid-multitouch.c. An attacker with physical access can trigger out-of-bounds write and escalate privileges on the system.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0466)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to unspecified error, related to I/O subsystem in kernel. A local user can elevated privileges on the system.
5) Use-after-free (CVE-ID: CVE-2020-14351)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the perf subsystem. A local user with permission to monitor perf events cam corrupt memory and execute arbitrary code with elevated privileges.
6) Out-of-bounds read (CVE-ID: CVE-2020-14390)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to an out-of-bounds read that occurs leading to memory corruption or a denial of service. This highest threat from this vulnerability is to system availability.
7) NULL pointer dereference (CVE-ID: CVE-2020-25285)
The vulnerability allows a local privileged user to execute arbitrary code.
The vulnerability exists due to NULL pointer dereference within the allowed_mems_nr(), hugetlb_sysctl_handler_common() and hugetlb_overcommit_handler() functions in mm/hugetlb.c. A local privileged user can execute arbitrary code.
8) Cleartext transmission of sensitive information (CVE-ID: CVE-2020-25645)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to traffic passed between two Geneve endpoints with configured IPsec can be unencrypted for the specific UDP port. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
9) Use after free (CVE-ID: CVE-2020-25669)
The vulnerability allows a local user to execute arbitrary code.
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
10) Null pointer dereference (CVE-ID: CVE-2020-27830)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.
11) Buffer overflow (CVE-ID: CVE-2020-36158)
The vulnerability allows a local privileged user to execute arbitrary code.
The vulnerability exists due to buffer overflow error within the mwifiex_cmd_802_11_ad_hoc_start() function in drivers/net/wireless/marvell/mwifiex/join.c. A local privileged user can execute arbitrary code.
12) Heap-based buffer overflow (CVE-ID: CVE-2021-20194)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the __cgroup_bpf_run_filter_getsockopt() function, when kernel is compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y ,
CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not
set, and BPF hook to getsockopt is registered. A local user can trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
13) Improper control of generation of code ('code injection') (CVE-ID: CVE-2021-3411)
The vulnerability allows a local privileged user to execute arbitrary code.
A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Remediation
Install update from vendor's website.