SB2021081841 - Ubuntu update for linux

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Security features bypass (CVE-ID: CVE-2020-26558)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an impersonation in the Passkey Entry protocol flaw. A remote attacker on the local network can perform a man-in-the-middle (MITM) attack and impersonate the initiating device without any previous knowledge.

Note: This vulnerability affects the following specifications:

• BR/EDR Secure Simple Pairing in Bluetooth Core Specifications 2.1 through 5.2
• BR/EDR Secure Connections Pairing in Bluetooth Core Specifications 4.1 through 5.2 
• LE Secure Connections Pairing in Bluetooth Core Specifications 4.2 through 5.2

2) Improper access control (CVE-ID: CVE-2021-0129)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated attacker on the local network can bypass implemented security restrictions and enable information disclosure

3) Use after free (CVE-ID: CVE-2021-28691)

The vulnerability allows a local user to execute arbitrary code.

Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.

4) Double Free (CVE-ID: CVE-2021-3564)

The vulnerability allows a local attacker to perform a denial of service attack.

The vulnerability exists due to bluetooth subsystem in the Linux kernel does not properly handle HCI device detach events. An attacker with physical access to the system can trigger double free error and perform a denial of service attack.

5) Use-after-free (CVE-ID: CVE-2021-3573)

The vulnerability allows local user to escalate their privileges on the system.

The vulnerability exists due to a use-after-free in hci_sock_bound_ioctl() function of the Linux kernel HCI subsystem triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user can use this flaw to crash the system or escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-5046-1