SB2021022547 - Ubuntu update for linux
Published: February 25, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Use after free (CVE-ID: CVE-2020-25669)
The vulnerability allows a local user to execute arbitrary code.
A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.
2) Out-of-bounds read (CVE-ID: CVE-2020-27815)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in fs/jfs/jfs_dmap.c. A local user can trigger out-of-bounds read error and crash the kernel.
3) Null pointer dereference (CVE-ID: CVE-2020-27830)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.
4) Release of invalid pointer or reference (CVE-ID: CVE-2020-28941)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to release of invalid pointer or reference error within the makefile. A local user can perform a denial of service (DoS) attack.
5) Race condition (CVE-ID: CVE-2020-29374)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a race condition in the mm/gup.c and mm/huge_memory.c in Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information.
6) Buffer overflow (CVE-ID: CVE-2020-29568)
The vulnerability allows a local authenticated user to a crash the entire system.
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.
7) Buffer overflow (CVE-ID: CVE-2020-29568)
The vulnerability allows a local authenticated user to a crash the entire system.
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.
8) Unchecked Return Value (CVE-ID: CVE-2020-29569)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to an unchecked return value. A local user can cause a denial of service (DoS) condition, leading to privilege escalation and information leaks.
9) Improper locking (CVE-ID: CVE-2020-29660)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to double-locking error in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c. An authenticated local user can exploit this vulnerability to perform a read-after-free attack against TIOCGSID and gain access to sensitive information.
10) Improper locking (CVE-ID: CVE-2020-29661)
The vulnerability allows a local user to perform a escalate privileges on the system.
The vulnerability exists due to locking error in the tty subsystem of the Linux kernel in drivers/tty/tty_jobctrl.c. An local user can exploit this vulnerability to trigger a use-after-free error against TIOCSPGRP and execute arbitrary code with elevated privileges.
Remediation
Install update from vendor's website.