SB2020082305 - Ubuntu update for linux-aws-5.3

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2020-12655)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in "xfs_agf_verify" in "fs/xfs/libxfs/xfs_alloc.c" file. A local user can use an XFS v5 image with crafted metadata, trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Input validation error (CVE-ID: CVE-2020-12771)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a deadlock if a coalescing operation fails in "btree_gc_coalesce" in "drivers/md/bcache/btree.c" file. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

3) Memory leak (CVE-ID: CVE-2020-15393)

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak in "drivers/usb/misc/usbtest.c" file. A local user can force the application to leak memory and perform denial of service attack.

4) Incorrect permission assignment for critical resource (CVE-ID: CVE-2020-24394)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to incorrect assignment of permissions on new filesystem objects when the filesystem lacks ACL support in fs/nfsd/vfs.c (in the NFS server). A local user can read and write arbitrary files on the system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4465-1