Ubuntu update for linux-oem-5.6

1) Command Injection

EUVDB-ID: #VU56241

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-29154

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect computation of branch displacements within the BPF JIT compilers in the Linux kernel in arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. A local user can inject and execute arbitrary commands with elevated privileges.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU47453

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2020-0423

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Binder component in OS kernel. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary code on the system.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Out-of-bounds write

EUVDB-ID: #VU66026

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0465

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to escalate privileges on the system.

The vulnerability exists due to an out of bounds write in various methods of hid-multitouch.c. An attacker with physical access can trigger out-of-bounds write and escalate privileges on the system.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU52033

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0466

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unspecified error, related to I/O subsystem in kernel. A local user can elevated privileges on the system.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU51544

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-14351

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the perf subsystem. A local user with permission to monitor perf events cam corrupt memory and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU47220

Risk: Medium

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-14390

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an out-of-bounds read that occurs leading to memory corruption or a denial of service. This highest threat from this vulnerability is to system availability.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) NULL pointer dereference

EUVDB-ID: #VU90669

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25285

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to NULL pointer dereference within the allowed_mems_nr(), hugetlb_sysctl_handler_common() and hugetlb_overcommit_handler() functions in mm/hugetlb.c. A local privileged user can execute arbitrary code.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Cleartext transmission of sensitive information

EUVDB-ID: #VU51546

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-25645

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to traffic passed between two Geneve endpoints with configured IPsec can be unencrypted for the specific UDP port. A remote attacker with ability to intercept network traffic can gain access to sensitive data.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use after free

EUVDB-ID: #VU92762

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25669

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Null pointer dereference

EUVDB-ID: #VU95192

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-27830

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU92419

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-36158

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to buffer overflow error within the mwifiex_cmd_802_11_ad_hoc_start() function in drivers/net/wireless/marvell/mwifiex/join.c. A local privileged user can execute arbitrary code.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Heap-based buffer overflow

EUVDB-ID: #VU60356

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-20194

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the __cgroup_bpf_run_filter_getsockopt() function, when kernel is compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered. A local user can trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper control of generation of code ('code injection')

EUVDB-ID: #VU92763

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3411

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local privileged user to execute arbitrary code.

A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Mitigation

Update the affected package linux-oem-5.6 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-oem-20.04 (Ubuntu package): before 5.6.0.1053.49

linux-image-5.6.0-1053-oem (Ubuntu package): before 5.6.0-1053.57

CPE2.3

• cpe:2.3:o:canonical:linux-image-oem-20.04:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:o:canonical:linux-image-5.6.0-1053-oem_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-4912-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.