Ubuntu update for linux

Published: 2021-06-03

Risk	High
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2020-25670 CVE-2020-25671 CVE-2020-25672 CVE-2020-25673 CVE-2021-29155 CVE-2021-3501
CWE-ID	CWE-416 CWE-401 CWE-400 CWE-125 CWE-787
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #5 is available.
Vulnerable software	Ubuntu Operating systems & Components / Operating system linux-image-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi-nolpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gke (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-64k (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-18-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-18-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-18-generic-64k (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-18-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1009-raspi-nolpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1009-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1008-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1008-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1008-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1007-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1006-azure (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU63652

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25670

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the NFC LLCP protocol implementation. A local user can perform manipulation with an unknown input for the llcp_sock_bind() function to crash or escalate their privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 21.04

linux-image-raspi (Ubuntu package): before 5.11.0.1009.7

linux-image-virtual (Ubuntu package): before 5.11.0.18.19

linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1009.7

linux-image-oracle (Ubuntu package): before 5.11.0.1007.7

linux-image-lowlatency (Ubuntu package): before 5.11.0.18.19

linux-image-kvm (Ubuntu package): before 5.11.0.1008.8

linux-image-gke (Ubuntu package): before 5.11.0.1008.8

linux-image-generic-lpae (Ubuntu package): before 5.11.0.18.19

linux-image-generic-64k (Ubuntu package): before 5.11.0.18.19

linux-image-generic (Ubuntu package): before 5.11.0.18.19

linux-image-gcp (Ubuntu package): before 5.11.0.1008.8

linux-image-azure (Ubuntu package): before 5.11.0.1006.6

linux-image-aws (Ubuntu package): before 5.11.0.1008.8

linux-image-5.11.0-18-lowlatency (Ubuntu package): before 5.11.0-18.19

linux-image-5.11.0-18-generic-lpae (Ubuntu package): before 5.11.0-18.19

linux-image-5.11.0-18-generic-64k (Ubuntu package): before 5.11.0-18.19

linux-image-5.11.0-18-generic (Ubuntu package): before 5.11.0-18.19

linux-image-5.11.0-1009-raspi-nolpae (Ubuntu package): before 5.11.0-1009.10

linux-image-5.11.0-1009-raspi (Ubuntu package): before 5.11.0-1009.10

linux-image-5.11.0-1008-kvm (Ubuntu package): before 5.11.0-1008.8

linux-image-5.11.0-1008-gcp (Ubuntu package): before 5.11.0-1008.9

linux-image-5.11.0-1008-aws (Ubuntu package): before 5.11.0-1008.8

linux-image-5.11.0-1007-oracle (Ubuntu package): before 5.11.0-1007.7

linux-image-5.11.0-1006-azure (Ubuntu package): before 5.11.0-1006.6

CPE2.3

External links

https://ubuntu.com/security/notices/USN-4977-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU63653

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25671

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the NFC LLCP protocol implementation. A local user can trigger the llcp_sock_connect() function to crash or escalate their privileges on the system.