USN-5106-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-5106-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5106-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-5106-1

Related

Published

2021-10-06T19:09:39.080498Z

Modified

2021-10-06T19:09:39.080498Z

Summary

linux-oem-5.10 vulnerabilities

Details

Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

It was discovered that the Linux kernel did not properly enforce certain types of entries in the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. An attacker could use this to bypass UEFI Secure Boot restrictions. (CVE-2020-26541)

It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. An attacker who could start and control a VM could possibly use this to expose sensitive information or execute arbitrary code. (CVE-2021-22543)

Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

References

Affected packages

Ubuntu:20.04:LTS / linux-oem-5.10

Package

Name: linux-oem-5.10
Purl: pkg:deb/ubuntu/linux-oem-5.10?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.10.0-1049.51

Affected versions

5.*

5.10.0-1008.9

5.10.0-1011.12

5.10.0-1013.14

5.10.0-1014.15

5.10.0-1016.17

5.10.0-1017.18

5.10.0-1019.20

5.10.0-1021.22

5.10.0-1022.23

5.10.0-1023.24

5.10.0-1025.26

5.10.0-1026.27

5.10.0-1029.30

5.10.0-1032.33

5.10.0-1033.34

5.10.0-1034.35

5.10.0-1038.40

5.10.0-1044.46

5.10.0-1045.47

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-buildinfo-5.10.0-1049-oem"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-headers-5.10.0-1049-oem"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-image-unsigned-5.10.0-1049-oem"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-image-unsigned-5.10.0-1049-oem-dbgsym"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-modules-5.10.0-1049-oem"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-oem-5.10-headers-5.10.0-1049"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-oem-5.10-tools-5.10.0-1049"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-oem-5.10-tools-host"
        },
        {
            "binary_version": "5.10.0-1049.51",
            "binary_name": "linux-tools-5.10.0-1049-oem"
        }
    ]
}