Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 7 |
CVE-ID | CVE-2021-20321 CVE-2021-3760 CVE-2021-4002 CVE-2021-41864 CVE-2021-43056 CVE-2021-43267 CVE-2021-43389 |
CWE-ID | CWE-362 CWE-416 CWE-401 CWE-787 CWE-252 CWE-119 CWE-129 |
Exploitation vector | Local network |
Public exploit | Public exploit code for vulnerability #6 is available. |
Vulnerable software |
Ubuntu Operating systems & Components / Operating system linux-image-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-64k-hwe-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae-hwe-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual-hwe-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-hwe-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency-hwe-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-44-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1021-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-44-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1023-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-44-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1023-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-44-generic-64k (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1023-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1024-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.11.0-1024-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1012-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1007-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1009-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gke (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-23-generic-64k (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-23-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi-nolpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1011-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1008-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-23-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-1008-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.13.0-23-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-64k (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-aws (Ubuntu package) Operating systems & Components / Operating system package or component |
Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 7 vulnerabilities.
EUVDB-ID: #VU59084
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-20321
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attacks.
The vulnerability exists due to a race condition when accessing file object in the Linux kernel OverlayFS subsystem. A local user can rename files in specific way with OverlayFS and perform a denial of service (DoS) attack.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63816
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3760
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the NFC stack. A local user can trigger use-after-free error to escalate privileges on the system.
MitigationUpdate the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63836
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-4002
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due memory leak in the Linux kernel's hugetlbfs memory usage. A local user can force the application to leak memory and gain access to sensitive information.
MitigationUpdate the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63855
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-41864
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input. A local user can gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information.
MitigationUpdate the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63921
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-43056
CWE-ID:
CWE-252 - Unchecked Return Value
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation error when handling SRR1 register values. A local user can perform a denial of service attack, when the host is running on Power8.
MitigationUpdate the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU58209
Risk: Medium
CVSSv4.0: 7.4 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2021-43267
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in net/tipc/crypto.c in the Linux kernel. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
A remote attacker can send specially crafted MSG_CRYPTO messages to the affected system, trigger memory corruption and execute arbitrary code on the system.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU63385
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-43389
CWE-ID:
CWE-129 - Improper Validation of Array Index
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to improper validation of array index in the ISDN CAPI implementation within detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can send specially crafted data to the system and execute arbitrary code with elevated privileges.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
linux-image-raspi (Ubuntu package): before 5.11.0.1024.22
linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package): before 5.11.0.44.48~20.04.22
linux-image-5.11.0-44-generic (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1021-kvm (Ubuntu package): before 5.11.0-1021.23
linux-image-5.11.0-44-generic-lpae (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-aws (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-lowlatency (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1023-azure (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-44-generic-64k (Ubuntu package): before 5.11.0-44.48~20.04.2
linux-image-5.11.0-1024-raspi-nolpae (Ubuntu package): before 5.11.0-1024.26
linux-image-5.11.0-1023-oracle (Ubuntu package): before 5.11.0-1023.24~20.04.1
linux-image-5.11.0-1024-gcp (Ubuntu package): before 5.11.0-1024.26~20.04.1
linux-image-5.11.0-1024-raspi (Ubuntu package): before 5.11.0-1024.26
linux-image-5.13.0-1012-raspi (Ubuntu package): before 5.13.0-1012.14
linux-image-lowlatency (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1007-kvm (Ubuntu package): before 5.13.0-1007.7
linux-image-generic-lpae (Ubuntu package): before 5.11.0.44.44
linux-image-5.13.0-1009-azure (Ubuntu package): before 5.13.0-1009.10
linux-image-gke (Ubuntu package): before 5.11.0.1024.24
linux-image-5.13.0-23-generic-64k (Ubuntu package): before 5.13.0-23.23
linux-image-oracle (Ubuntu package): before 5.11.0.1023.24~20.04.16
linux-image-5.13.0-1012-raspi-nolpae (Ubuntu package): before 5.13.0-1012.14
linux-image-gcp (Ubuntu package): before 5.11.0.1024.24
linux-image-kvm (Ubuntu package): before 5.11.0.1021.22
linux-image-5.13.0-23-lowlatency (Ubuntu package): before 5.13.0-23.23
linux-image-oem-20.04 (Ubuntu package): before 5.11.0.44.44
linux-image-raspi-nolpae (Ubuntu package): before 5.11.0.1024.22
linux-image-5.13.0-1011-oracle (Ubuntu package): before 5.13.0-1011.13
linux-image-azure (Ubuntu package): before 5.11.0.1023.24~20.04.23
linux-image-5.13.0-1008-gcp (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic (Ubuntu package): before 5.13.0-23.23
linux-image-5.13.0-1008-aws (Ubuntu package): before 5.13.0-1008.9
linux-image-5.13.0-23-generic-lpae (Ubuntu package): before 5.13.0-23.23
linux-image-generic (Ubuntu package): before 5.11.0.44.44
linux-image-generic-64k (Ubuntu package): before 5.11.0.44.44
linux-image-virtual (Ubuntu package): before 5.11.0.44.44
linux-image-aws (Ubuntu package): before 5.11.0.1023.24~20.04.23
CPE2.3https://ubuntu.com/security/notices/USN-5208-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.