SB2020101417 - Ubuntu update for linux

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2020-16119)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error caused by the reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

2) Out-of-bounds read (CVE-ID: CVE-2020-14314)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists.

3) Buffer overflow (CVE-ID: CVE-2020-14385)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the file system metadata validator in XFS. A local user can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt and shutdown the the filesystem.

4) Security restrictions bypass (CVE-ID: CVE-2020-16120)

The vulnerability allows a local privileged user to gain access to sensitive information.

The vulnerability exists due to security restrictions bypass error within the ovl_open_realfile() and ovl_change_flags() functions in fs/overlayfs/file.c. A local privileged user can gain access to sensitive information.

5) NULL pointer dereference (CVE-ID: CVE-2020-25285)

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to NULL pointer dereference within the allowed_mems_nr(), hugetlb_sysctl_handler_common() and hugetlb_overcommit_handler() functions in mm/hugetlb.c. A local privileged user can execute arbitrary code.

6) Infinite loop (CVE-ID: CVE-2020-25641)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect implementation of biovecs in Linux kernel. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. A local user can issue requests to a block device and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4576-1