SB2025011725 - Multiple vulnerabilities in IBM Spectrum Protect Plus
Published: January 17, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 36 secuirty vulnerabilities.
1) Excessive Iteration (CVE-ID: CVE-2021-28950)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to excessive iteration in fs/fuse/fuse_i.h in the Linux kernel. A local user can run a specially crafted program to perform a denial of service attack.
2) Use-after-free (CVE-ID: CVE-2021-4154)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the cgroup1_parse_param() function in kernel/cgroup/cgroup-v1.c in Linux kernel's cgroup v1 parser. A local user can execute arbitrary code via the fsconfig syscall parameter leading to a container breakout.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-22942)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error in the vmwgfx driver in Linux kernel. A local unprivileged user can gain access to files opened by other processes on the system through a dangling 'file' pointer.
Exploiting this vulnerability requires an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor.
4) NULL pointer dereference (CVE-ID: CVE-2022-0286)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the Linux kernel’s bonding driver when user bonds non existing or fake device. A local user can perform a denial of service (DoS) attack.
5) Buffer overflow (CVE-ID: CVE-2021-4157)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Linux kernel NFS subsystem. A remote attacker can create a specially crafted data and crash the system or escalate privileges on the system
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Race condition (CVE-ID: CVE-2021-20321)
The vulnerability allows a local user to perform a denial of service (DoS) attacks.
The vulnerability exists due to a race condition when accessing file object in the Linux kernel OverlayFS subsystem. A local user can rename files in specific way with OverlayFS and perform a denial of service (DoS) attack.
7) Incorrect default permissions (CVE-ID: CVE-2021-20269)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user can read arbitrary files and leak kernel internal information from a previous panic.
8) Resource exhaustion (CVE-ID: CVE-2021-28971)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to mishandling of PEBS status in a PEBS record In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
9) Buffer overflow (CVE-ID: CVE-2021-29650)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the netfilter subsystem in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h. A local user can trigger memory corruption upon the assignment of a new table value and cause denial of service.
10) Use-after-free (CVE-ID: CVE-2021-4083)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the Linux kernel's garbage collection for Unix domain socket file handlers. A local user can call close() and fget() simultaneously and can potentially trigger a race condition, which in turn leads to a use-after-free error and allows privilege escalation.
11) Information disclosure (CVE-ID: CVE-2021-45485)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error in the IPv6 implementation in the Linux kernel. A remote attacker can gain access to sensitive information.
12) Integer overflow (CVE-ID: CVE-2022-0185)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow in the legacy_parse_param() function in fs/fs_context.c in Linux kernel. A local user can tun a specially crafted program to trigger integer overflow and execute arbitrary code with root privileges.
13) Memory leak (CVE-ID: CVE-2021-4002)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due memory leak in the Linux kernel's hugetlbfs memory usage. A local user can force the application to leak memory and gain access to sensitive information.
14) Information disclosure (CVE-ID: CVE-2021-21781)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the ARM SIGPAGE functionality. A userland application can read the contents of the sigpage, which can leak kernel memory contents.
15) Resource exhaustion (CVE-ID: CVE-2021-3669)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to measuring usage of the shared memory does not scale with large shared memory segment counts. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
16) Buffer overflow (CVE-ID: CVE-2021-3635)
The vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a boundary error in the Linux kernel netfilter implementation. A local user with root (CAP_SYS_ADMIN) access can panic the system when issuing netfilter netflow commands.
17) Use-after-free (CVE-ID: CVE-2020-36385)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in drivers/infiniband/core/ucma.c, because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. A local user can run a specially crafted program to trigger the use-after-free error and execute arbitrary code with elevated privileges.
18) Out-of-bounds read (CVE-ID: CVE-2021-38201)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
19) Use-after-free (CVE-ID: CVE-2021-3573)
The vulnerability allows local user to escalate their privileges on the system.
The vulnerability exists due to a use-after-free in hci_sock_bound_ioctl() function of the Linux kernel HCI subsystem triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user can use this flaw to crash the system or escalate privileges on the system.
20) Out-of-bounds write (CVE-ID: CVE-2020-29368)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input within the __split_huge_pmd() function in mm/huge_memory.c in the Linux kernel. A local user can abuse the copy-on-write implementation and gain unintended write access because of a race condition in a THP mapcount check.
21) Use of uninitialized resource (CVE-ID: CVE-2022-0847)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an uninitialized resources. A local user can overwrite arbitrary file in the page cache, even if the file is read-only, and execute arbitrary code on the system with elevated privileges.
The vulnerability was dubbed Dirty Pipe.
22) Information disclosure (CVE-ID: CVE-2022-0850)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the copy_page_to_iter() function in iov_iter.c in Linux kernel. A local user can gain unauthorized access to sensitive information on the system.
23) Use-after-free (CVE-ID: CVE-2021-4203)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in sock_getsockopt() function in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() function (and connect() function) in the Linux kernel. A local user can exploit the use-after-free error and crash the system or escalate privileges on the system.
24) Use-after-free (CVE-ID: CVE-2021-44733)
The vulnerability allows a local user to elevate privileges on the system.
The vulnerability exists due to a use-after-free error in the drivers/tee/tee_shm.c file within the TEE subsystem in the Linux kernel. A local user can trigger a race condition in tee_shm_get_from_id during an attempt to free a shared memory object and execute arbitrary code with elevated privileges.
25) Information disclosure (CVE-ID: CVE-2021-45486)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to incorrect implementation of the IPv4 protocol in the Linux kernel. A remote attacker can disclose internal state in some situations.
26) Security restrictions bypass (CVE-ID: CVE-2021-4197)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to missing permissions checks within the cgroups (control groups) functionality of Linux Kernel when writing into a file descriptor. A local low privileged process can trick a higher privileged parent process into writing arbitrary data into files, which can result in denial of service or privileges escalation.
27) Out-of-bounds write (CVE-ID: CVE-2021-31916)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module. A special user (CAP_SYS_ADMIN) can trigger a buffer overflow in the ioctl for listing devices and escalate privileges on the system.
28) Memory leak (CVE-ID: CVE-2021-3764)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak error in the ccp_run_aes_gcm_cmd() function in Linux kernel. A local user can trigger a memory leak error and perform a denial of service (DoS) attack.
29) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-0492)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a logic error within the cgroup_release_agent_write() function in kernel/cgroup/cgroup-v1.c. A local user can use the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation.
30) Use-after-free (CVE-ID: CVE-2021-4028)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the RDMA listen()
function in Linux kernel. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with elevated privileges.
31) Out-of-bounds write (CVE-ID: CVE-2021-41864)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input. A local user can gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information.
32) Improper Resource Shutdown or Release (CVE-ID: CVE-2020-36322)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists in the FUSE filesystem implementation in the Linux kernel due to fuse_do_getattr() calls make_bad_inode() in inappropriate situations. A local user can run a specially crafted program to trigger kernel crash.
Note, the vulnerability exists due to incomplete fix for #VU58207 (CVE-2021-28950).
33) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-4155)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to the OS kernel does not impose correctly security restrictions. A local user can gain access to sensitive information on the system.
34) Use-after-free (CVE-ID: CVE-2022-1011)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the write() function of FUSE filesystem. A local user can retireve (partial) /etc/shadow hashes and execute arbitrary code with elevated privileges.
35) Memory leak (CVE-ID: CVE-2020-25704)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the Linux kernel performance monitoring subsystem when using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.
36) Use of insufficiently random values (CVE-ID: CVE-2021-20322)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error when processing received ICMP errors. A remote attacker can effectively bypass the source port UDP randomization to gain access to sensitive information.
Remediation
Install update from vendor's website.