Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3870
USN-5137-2: Linux kernel vulnerabilities
12 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Linux kernel
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2021-35477 CVE-2021-34556 CVE-2021-3759
CVE-2021-3753 CVE-2021-3743 CVE-2021-3739
CVE-2021-3428 CVE-2020-36385 CVE-2019-19449
Reference: ESB-2021.3743
ESB-2021.3456
ESB-2021.3391
Original Bulletin:
https://ubuntu.com/security/notices/USN-5137-2
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-5137-2: Linux kernel vulnerabilities
11 November 2021
Several security issues were fixed in the Linux kernel.
Releases
o Ubuntu 20.04 LTS
o Ubuntu 18.04 LTS
Packages
o linux-bluefield - Linux kernel for NVIDIA BlueField platforms
o linux-gke-5.4 - Linux kernel for Google Container Engine (GKE) systems
o linux-oracle - Linux kernel for Oracle Cloud systems
o linux-oracle-5.4 - Linux kernel for Oracle Cloud systems
Details
It was discovered that the f2fs file system in the Linux kernel did not
properly validate metadata in some situations. An attacker could use this
to construct a malicious f2fs image that, when mounted and operated on,
could cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-19449)
It was discovered that the Infiniband RDMA userspace connection manager
implementation in the Linux kernel contained a race condition leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possible execute arbitrary code.
(CVE-2020-36385)
Wolfgang Frisch discovered that the ext4 file system implementation in the
Linux kernel contained an integer overflow when handling metadata inode
extents. An attacker could use this to construct a malicious ext4 file
system image that, when mounted, could cause a denial of service (system
crash). (CVE-2021-3428)
Benedict Schlueter discovered that the BPF subsystem in the Linux kernel
did not properly protect against Speculative Store Bypass (SSB) side-
channel attacks in some situations. A local attacker could possibly use
this to expose sensitive information. (CVE-2021-34556)
Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not
properly protect against Speculative Store Bypass (SSB) side-channel
attacks in some situations. A local attacker could possibly use this to
expose sensitive information. (CVE-2021-35477)
It was discovered that the btrfs file system in the Linux kernel did not
properly handle removing a non-existent device id. An attacker with
CAP_SYS_ADMIN could use this to cause a denial of service. (CVE-2021-3739)
It was discovered that the Qualcomm IPC Router protocol implementation in
the Linux kernel did not properly validate metadata in some situations. A
local attacker could use this to cause a denial of service (system crash)
or expose sensitive information. (CVE-2021-3743)
It was discovered that the virtual terminal (vt) device implementation in
the Linux kernel contained a race condition in its ioctl handling that led
to an out-of-bounds read vulnerability. A local attacker could possibly use
this to expose sensitive information. (CVE-2021-3753)
It was discovered that the Linux kernel did not properly account for the
memory usage of certain IPC objects. A local attacker could use this to
cause a denial of service (memory exhaustion). (CVE-2021-3759)
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 20.04
o linux-image-bluefield - 5.4.0.1021.22
o linux-image-oracle-lts-20.04 - 5.4.0.1057.57
o linux-image-5.4.0-1021-bluefield - 5.4.0-1021.24
o linux-image-5.4.0-1057-oracle - 5.4.0-1057.61
Ubuntu 18.04
o linux-image-oracle - 5.4.0.1057.61~18.04.37
o linux-image-5.4.0-1055-gke - 5.4.0-1055.58~18.04.1
o linux-image-gke-5.4 - 5.4.0.1055.58~18.04.20
o linux-image-5.4.0-1057-oracle - 5.4.0-1057.61~18.04.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References
o CVE-2021-3759
o CVE-2021-3428
o CVE-2021-3743
o CVE-2021-34556
o CVE-2021-3739
o CVE-2021-3753
o CVE-2021-35477
o CVE-2020-36385
o CVE-2019-19449
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYY3QoONLKJtyKPYoAQgfGA/9EbP6wy0kInME3ZqXMx0Tp0eHMFKSvXzo
MZsL/MiaKw9oujNNeYx5hYUXlfGeXAOdVL4ra8Y/ubxe6ya8VwVVL4/JUDU++5ja
J14gRPfx83qeCs1i8j7Mg6fADmqVRw0i8rT4MUCvs5D+1FiCePVtBBY1tc6XjOAJ
0FYWdt81NhxK1+su4ajXrDd53jzDp+Jbb7d+aTqOj5aQodSMEtgS9bLsuvGzQ+bf
AptorvbpplQq104APD72+Q4+7a+qwJnLtDOrp/ThQ3GxB7sWX0MB72EDfYtOb7cU
XjxElb1/uuSQ9stoOSrB1+ZlnKEoIFGg6GEZUs53spi1bV6FTKvzr+DEpqQjBYpY
Se8/PF1rEpTtKxw23T89k6Bsx1OWPDi/l59GRPYUgEkJI15pF+PkPygaNTLgqHhq
wRP7UF79BhbmSvwpJhvq3N/K6tPBcVQzXXPcERbBVWk7mTuLLwkSN3lZmIenvY85
WNRxCCeFwO4nhFER7pSmKjYXE0MI/kQ5nV6myJJE15FpC0UKBkEiUmQG6bhVkLZv
OvhgCslxrIzNr79x4f9EbyHgM0uLwVqcLU7Ii4yStb4cVCdaltHYPUj7DBdHKteW
Flk+MUjbj+tmYOOPdODSNsQr7AGIYHv4wD8lItDP1hQoxa+Ub3ZLkUgDPD5Ht+IQ
KObcIPEet4g=
=MqJl
-----END PGP SIGNATURE-----