SB2021062115 - Red Hat Enterprise Linux 7 update for kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021062115

SB2021062115 - Red Hat Enterprise Linux 7 update for kernel

Published: June 21, 2021

Security Bulletin ID SB2021062115
Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2020-8648)

The vulnerability allows a local authenticated user to #BASIC_IMPACT#.

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.


2) Integer overflow (CVE-ID: CVE-2020-12362)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with elevated privileges.


3) Input validation error (CVE-ID: CVE-2020-12363)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A local user can run a specially crafted program to perform a denial of service (DoS) attack.


4) NULL pointer dereference (CVE-ID: CVE-2020-12364)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A local user can run a specially crafted program to perform a denial of service (DoS) attack.


5) Observable discrepancy (CVE-ID: CVE-2020-27170)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in kernel/bpf/verifier.c due to kernel performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations. A local user can run a specially crafted program to gain access to sensitive information.


6) Use-after-free (CVE-ID: CVE-2021-3347)

The vulnerability allows a local user to elevate privileges on the system.

The vulnerability exists due to a use-after-free error when handling PI futexes. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with elevated privileges.



Remediation

Install update from vendor's website.

References