SB2022020344 - Ubuntu update for linux
Published: February 3, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2020-27820)
The vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to a use-after-free error in nouveau's postclose() handler. A local user can send specially crafted data to the system and execute arbitrary code with elevated privileges.
2) Use-after-free (CVE-ID: CVE-2021-3640)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in sco_sock_sendmsg() function of the Linux kernel HCI subsystem. A privileged local user can call ioct UFFDIO_REGISTER or other way trigger race condition to escalate privileges on the system.
3) Use-after-free (CVE-ID: CVE-2021-3752)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the Linux kernel’s Bluetooth subsystem when a user calls connect to the socket and disconnect simultaneously. A local user can escalate privileges on the system.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2021-3772)
The vulnerability allows a remote attacker to perform a denial of service attack (DoS) on the target system.The vulnerability exists due to insufficient verification of data authenticity in the Linux SCTP stack. A remote attacker can exploit this vulnerability to perform a denial of service attack.
5) Race condition (CVE-ID: CVE-2021-4001)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in kernel/bpf/syscall.c in Linux kernel ebpf. A local user can exploit the race between bpf_map_update_elem and bpf_map_freeze and modify the frozen mapped address space.
6) Out-of-bounds write (CVE-ID: CVE-2021-4090)
The vulnerability allows a local user to read and manipulate data.
An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.
7) Out-of-bounds read (CVE-ID: CVE-2021-4093)
The vulnerability allows a local user to escalate privileges on the system.
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.
8) Use-after-free (CVE-ID: CVE-2021-4202)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the nci_request() function in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. A local user can cause a data race problem while the device is getting removed and escalate privileges on the system.
9) Out-of-bounds write (CVE-ID: CVE-2021-42327)
The vulnerability allows a local privileged user to execute arbitrary code.
The vulnerability exists due to out-of-bounds write error. A local privileged user can execute arbitrary code.
10) Buffer overflow (CVE-ID: CVE-2021-42739)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary within the firewire subsystem in the Linux kernel in drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c files. A local privileged user can run a specially crafted program tat calls avc_ca_pmt() function to trigger memory corruption and execute arbitrary code with elevated privileges.
Remediation
Install update from vendor's website.