Ubuntu update for linux-azure-5.8



Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2019-19449
CVE-2020-26541
CVE-2020-36311
CVE-2021-22543
CVE-2021-3612
CVE-2021-3759
CVE-2021-38199
CVE-2021-38207
CVE-2021-40490
CWE-ID CWE-125
CWE-693
CWE-264
CWE-119
CWE-787
CWE-400
CWE-362
CWE-120
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

linux-image-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.8.0-1043-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU34984

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-19449

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment.c, related to init_min_max_mtime in fs/f2fs/segment.c (because the second argument to get_seg_entry is not validated).

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Protection Mechanism Failure

EUVDB-ID: #VU54455

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26541

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU55262

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-36311

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to an error in arch/x86/kvm/svm/sev.c in Linux kernel, which allows soft lockup by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions).

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU56018

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-22543

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Linux kernel when handling VM_IO|VM_PFNMAP vmas in KVM. A local user can  can bypass RO checks and cause the pages to get freed while still accessible by the VMM and guest. As a result, an attacker with the ability to start and control a VM to read/write random pages of memory, can trigger memory corruption and execute arbitrary code with elevated privileges.


Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Out-of-bounds write

EUVDB-ID: #VU55231

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3612

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in joystick devices subsystem in Linux kernel. A local user can make a specially crafted JSIOCSBTNMAP IOCTL call, trigger out-of-bounds write and execute arbitrary code with escalated privileges.

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU63914

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3759

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists in the Linux kernel’s ipc functionality of the memcg subsystem when user calls the semget function multiple times, creating semaphores. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Race condition

EUVDB-ID: #VU61208

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-38199

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to fs/nfs/nfs4client.c in the Linux kernel has incorrect connection-setup ordering. A remote attacker with access to a remote NFSv4 server can perform a denial of service (DoS) attack by arranging the server to be unreachable during trunking detection.

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU92752

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-38207

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about 10 minutes.

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Race condition

EUVDB-ID: #VU63667

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-40490

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Update the affected package linux-azure-5.8 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-azure (Ubuntu package): before 5.8.0.1043.46~20.04.15

linux-image-5.8.0-1043-azure (Ubuntu package): before 5.8.0-1043.46~20.04.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5120-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###