SB2020070622 - Ubuntu update for linux
Published: July 6, 2020 Updated: April 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Resource management error (CVE-ID: CVE-2019-16089)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to nbd_genl_status() function in drivers/block/nbd.c does not check the nla_nest_start_noflag return value. A local user can run a specially crafted program to cause the kernel to crash.
2) Null pointer dereference (CVE-ID: CVE-2019-19036)
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
3) Use after free (CVE-ID: CVE-2019-19318)
The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.
In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
4) Use-after-free (CVE-ID: CVE-2019-19813)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.
5) Out-of-bounds write (CVE-ID: CVE-2019-19816)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.
6) Use-after-free (CVE-ID: CVE-2019-19377)
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
7) Null pointer dereference (CVE-ID: CVE-2019-19462)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
8) NULL pointer dereference (CVE-ID: CVE-2020-10711)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the Linux kernel's SELinux subsystem when importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated.
A remote attacker can send specially crafted packets the affected system, trigger a NULL pointer dereference error and crash the Linux kernel.
9) Input validation error (CVE-ID: CVE-2020-12770)
The vulnerability allows a local user to execute arbitrary code on the system.
The vulnerability exists due to the "sg_write" lacks an "sg_remove_request" call in a certain failure case. A local user can pass specially crafted input to the application and execute arbitrary code on the target system.
10) Out-of-bounds read (CVE-ID: CVE-2020-13143)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in "gadget_dev_desc_UDC_store" in "drivers/usb/gadget/configfs.c" file. A remote attacker can trigger out-of-bounds read error and cause a denial of service on the target system.
Remediation
Install update from vendor's website.