Ubuntu update for linux



Risk Medium
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2015-1350
CVE-2017-16644
CVE-2017-5967
CVE-2018-13095
CVE-2019-16231
CVE-2019-16232
CVE-2019-19061
CVE-2021-20261
CVE-2021-26930
CVE-2021-26931
CVE-2021-28038
CWE-ID CWE-264
CWE-388
CWE-200
CWE-476
CWE-401
CWE-362
CWE-399
CWE-770
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

linux-image-virtual-lts-xenial (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency-lts-xenial (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lts-xenial (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae-lts-xenial (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-1090-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-1126-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-snapdragon (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-raspi2 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-powerpc64-smp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-powerpc64-emb (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-powerpc-smp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-powerpc-e500mc (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-powerpc-smp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-1154-snapdragon (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-1150-raspi2 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.4.0-1091-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Denial of service

EUVDB-ID: #VU6551

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-1350

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS conditions on the target system.

The weakness exists due to underspecified removing of extended privilege attributes caused by incomplete set of requirements for setattr operations. A local can invoke chown or system call, trigger an error in notify_change for filesystem xattrs and cause the ping or Wireshark dumpcap program to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Error handling

EUVDB-ID: #VU9766

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-16644

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to an error in the hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through in the Linux kernel. A local attacker can supply a specially crafted USB device, trigger improper error handling and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information exposure

EUVDB-ID: #VU92438

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5967

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to information exposure error within the __queue_delayed_work() function in kernel/workqueue.c, within the copyright() function in kernel/time/timer_stats.c, within the print_timer() function in kernel/time/timer_list.c, within the internal_add_timer(), do_init_timer(), __mod_timer(), add_timer_on(), del_timer(), try_to_del_timer_sync(), expire_timers() and init_timer_cpus() functions in kernel/time/timer.c, within the hrtimers_resume(), remove_hrtimer(), hrtimer_start_range_ns(), __hrtimer_init() and __run_hrtimer() functions in kernel/time/hrtimer.c, within the __kthread_queue_delayed_work() function in kernel/kthread.c. A local non-authenticated attacker can gain access to sensitive information.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Null pointer dereference

EUVDB-ID: #VU13851

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-13095

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists in the xfs_bmap_extents_to_btree() function in the Extended File System (XFS) component, as defined in the source code file fs/xfs/libxfs/xfs_inode_buf.c due to boundary error when mounting XFS filesystems. A local attacker can access the system, mount an XFS filesystem that submits malicious input, trigger a NULL pointer dereference memory error and cause the affected software to terminate abnormally.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Null pointer dereference

EUVDB-ID: #VU92783

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-16231

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Null pointer dereference

EUVDB-ID: #VU92782

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-16232

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory leak

EUVDB-ID: #VU24432

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-19061

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the "adis_update_scan_mode_burst()" function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows a local user to cause a denial of service (memory consumption).

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Race condition

EUVDB-ID: #VU91489

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-20261

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to a race condition within the set_fdc(), do_format(), user_reset_fdc(), set_geometry(), get_floppy_geometry(), fd_locked_ioctl(), floppy_check_events() and floppy_revalidate() functions in drivers/block/floppy.c. A local privileged user can execute arbitrary code.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource management error

EUVDB-ID: #VU51587

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-26930

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when processing service requests to the PV backend within drivers/block/xen-blkback/blkback.c driver in Xen. A local user on the guest OS can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Allocation of resources without limits or throttling

EUVDB-ID: #VU92418

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-26931

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling error within the scsiback_gnttab_data_map_batch() function in drivers/xen/xen-scsiback.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Allocation of resources without limits or throttling

EUVDB-ID: #VU92417

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-28038

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a local user to a crash the entire system.

The vulnerability exists due to allocation of resources without limits or throttling error within the xenvif_tx_action() function in drivers/net/xen-netback/netback.c. A local user can a crash the entire system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

linux-image-virtual-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-lowlatency-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-generic-lpae-lts-xenial (Ubuntu package): before 4.4.0.208.181

linux-image-4.4.0-1090-aws (Ubuntu package): before 4.4.0-1090.94

linux-image-aws (Ubuntu package): before 4.4.0.1090.87

linux-image-4.4.0-208-lowlatency (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic-lpae (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-208-generic (Ubuntu package): before 4.4.0-208.240~14.04.1

linux-image-4.4.0-1126-aws (Ubuntu package): before 4.4.0-1126.140

linux-image-virtual (Ubuntu package): before 4.4.0.208.214

linux-image-snapdragon (Ubuntu package): before 4.4.0.1154.146

linux-image-raspi2 (Ubuntu package): before 4.4.0.1150.150

linux-image-powerpc64-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc64-emb (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-smp (Ubuntu package): before 4.4.0.208.214

linux-image-powerpc-e500mc (Ubuntu package): before 4.4.0.208.214

linux-image-lowlatency (Ubuntu package): before 4.4.0.208.214

linux-image-kvm (Ubuntu package): before 4.4.0.1091.89

linux-image-generic-lpae (Ubuntu package): before 4.4.0.208.214

linux-image-generic (Ubuntu package): before 4.4.0.208.214

linux-image-4.4.0-208-powerpc64-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc64-emb (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-smp (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package): before 4.4.0-208.240

linux-image-4.4.0-1154-snapdragon (Ubuntu package): before 4.4.0-1154.164

linux-image-4.4.0-1150-raspi2 (Ubuntu package): before 4.4.0-1150.161

linux-image-4.4.0-1091-kvm (Ubuntu package): before 4.4.0-1091.100

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4904-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###