Ubuntu update for linux



Risk High
Patch available YES
Number of vulnerabilities 17
CVE-ID CVE-2021-3609
CVE-2021-33200
CVE-2020-24586
CVE-2020-24587
CVE-2020-24588
CVE-2020-25670
CVE-2020-25671
CVE-2020-25672
CVE-2020-25673
CVE-2020-26139
CVE-2020-26141
CVE-2020-26145
CVE-2020-26147
CVE-2021-23133
CVE-2021-29155
CVE-2021-31440
CVE-2021-31829
CWE-ID CWE-362
CWE-787
CWE-20
CWE-451
CWE-416
CWE-401
CWE-400
CWE-125
CWE-682
CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #15 is available.
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

linux-image-raspi (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-hwe-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency-hwe-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-64k-hwe-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual-hwe-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-59-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1035-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1030-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1033-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1036-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-64k (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gke (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-59-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-59-generic-64k (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-raspi-nolpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1038-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1029-raspi (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-59-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 17 vulnerabilities.

1) Race condition

EUVDB-ID: #VU54292

Risk: Medium

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-3609

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the CAN BCM networking protocol (net/can/bcm.c) in the Linux kernel ranging from version 2.6.25 to mainline 5.13-rc6. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Out-of-bounds write

EUVDB-ID: #VU87989

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-33200

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in kernel/bpf/verifier.c. A local user can trigger an out-of-bounds write and escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU53154

Risk: Low

CVSSv4.0: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24586

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the 802.11 standard due to the affected device does not clear its cache/memory to remove fragments of an incomplete MSDU/MMPDU from previous session after reconnection/reassociation. A remote attacker on the local network can perform a fragment cache attack and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU53096

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24587

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Wireless Networking. A remote attacker on the local network can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Spoofing attack

EUVDB-ID: #VU53098

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24588

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in Windows Wireless Networking. A remote attacker on the local network can spoof page content.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU63652

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25670

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the NFC LLCP protocol implementation. A local user can perform manipulation with an unknown input for the llcp_sock_bind() function to crash or escalate their privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU63653

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25671

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the NFC LLCP protocol implementation. A local user can trigger the llcp_sock_connect() function to crash or escalate their privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU63654

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-25672

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the NFC LLCP protocol implementation when triggering the llcp_sock_connect() function. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU63656

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-25673

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper control consumption of internal resources in non-blocking socket in llcp_sock_connect() function. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU53174

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26139

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to forwarding EAPOL frames even though the sender is not yet authenticated. A remote attacker on the local network can cause a denial of service (DoS) condition on the target system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU53176

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26141

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. A remote attacker on the local network can inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Input validation error

EUVDB-ID: #VU53155

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26145

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. A remote attacker on the local network can inject arbitrary network packets independent of the network configuration.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Input validation error

EUVDB-ID: #VU53172

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26147

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. A remote attacker on the local network can inject packets and/or exfiltrate selected fragments

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Race condition

EUVDB-ID: #VU53006

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-23133

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Linux kernel SCTP sockets (net/sctp/socket.c). If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by a local user with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds read

EUVDB-ID: #VU67490

Risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-29155

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: Yes

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists in retrieve_ptr_limit in kernel/bpf/verifier.c in the Linux kernel mechanism. A local, special user privileged (CAP_SYS_ADMIN) BPF program running on affected systems may bypass the protection, and execute speculatively out-of-bounds loads from the kernel memory.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

16) Incorrect calculation

EUVDB-ID: #VU64201

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-31440

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to out-of-bounds access flaw in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking unsigned 32-bit instructions in an eBPF program occurs. A local user can use this flaw to crash the system or possibly escalate their privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Information disclosure

EUVDB-ID: #VU67181

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-31829

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the Linux kernel's eBPF verification code. A local user can insert eBPF instructions, use the eBPF verifier to abuse a spectre-like flaw and infer all system memory.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

linux-image-raspi (Ubuntu package): before 5.8.0.1029.31

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.8.0.59.66~20.04.42

linux-image-lowlatency (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-1035-gcp (Ubuntu package): before 5.8.0-1035.37~20.04.1

linux-image-5.8.0-1029-raspi-nolpae (Ubuntu package): before 5.8.0-1029.32

linux-image-gcp (Ubuntu package): before 5.8.0.1035.35

linux-image-generic-lpae (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-1030-kvm (Ubuntu package): before 5.8.0-1030.32

linux-image-kvm (Ubuntu package): before 5.8.0.1030.32

linux-image-aws (Ubuntu package): before 5.8.0.1038.40~20.04.11

linux-image-5.8.0-1033-oracle (Ubuntu package): before 5.8.0-1033.34~20.04.1

linux-image-5.8.0-1036-azure (Ubuntu package): before 5.8.0-1036.38~20.04.1

linux-image-generic (Ubuntu package): before 5.8.0.59.64

linux-image-generic-64k (Ubuntu package): before 5.8.0.59.64

linux-image-gke (Ubuntu package): before 5.8.0.1035.35

linux-image-virtual (Ubuntu package): before 5.8.0.59.64

linux-image-5.8.0-59-generic-lpae (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-5.8.0-59-generic-64k (Ubuntu package): before 5.8.0-59.66~20.04.1

linux-image-raspi-nolpae (Ubuntu package): before 5.8.0.1029.31

linux-image-azure (Ubuntu package): before 5.8.0.1036.36

linux-image-oracle (Ubuntu package): before 5.8.0.1033.32

linux-image-5.8.0-1038-aws (Ubuntu package): before 5.8.0-1038.40~20.04.1

linux-image-5.8.0-1029-raspi (Ubuntu package): before 5.8.0-1029.32

linux-image-5.8.0-59-lowlatency (Ubuntu package): before 5.8.0-59.66~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4999-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###