Saturday, May 15, 2021

Ubuntu: (Multiple Advisories) (CVE-2021-3490): Linux kernel vulnerabilities

Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.From USN-4950-1:Ryota Shiga discovered that the eBPF implementation in the Linux kernel did not properly verify that a BPF program only reserved as much memory for a ring buffer as was allocated. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3489)Manfred Paul discovered that the eBPF implementation in the Linux kernel did not properly track bounds on bitwise operations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3490)Billy Jheng Bing-Jhong discovered that the io_uring implementation of the Linux kernel did not properly enforce the MAX_RW_COUNT limit in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3491)Norbert Slusarek discovered that the CAN ISOTP protocol implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that to address this issue, SF_BROADCAST support was removed temporarily from the CAN ISOTP implementation in Ubuntu 21.04 kernels. (LP: #1927409)
Solution(s)
  • ubuntu-upgrade-linux-image-5-10-0-1026-oem
  • ubuntu-upgrade-linux-image-5-11-0-1005-azure
  • ubuntu-upgrade-linux-image-5-11-0-1006-oracle
  • ubuntu-upgrade-linux-image-5-11-0-1007-aws
  • ubuntu-upgrade-linux-image-5-11-0-1007-gcp
  • ubuntu-upgrade-linux-image-5-11-0-1007-kvm
  • ubuntu-upgrade-linux-image-5-11-0-1008-raspi
  • ubuntu-upgrade-linux-image-5-11-0-1008-raspi-nolpae
  • ubuntu-upgrade-linux-image-5-11-0-17-generic
  • ubuntu-upgrade-linux-image-5-11-0-17-generic-64k
  • ubuntu-upgrade-linux-image-5-11-0-17-generic-lpae
  • ubuntu-upgrade-linux-image-5-11-0-17-lowlatency
  • ubuntu-upgrade-linux-image-5-8-0-1024-raspi
  • ubuntu-upgrade-linux-image-5-8-0-1024-raspi-nolpae
  • ubuntu-upgrade-linux-image-5-8-0-1027-kvm
  • ubuntu-upgrade-linux-image-5-8-0-1029-oracle
  • ubuntu-upgrade-linux-image-5-8-0-1031-gcp
  • ubuntu-upgrade-linux-image-5-8-0-1032-azure
  • ubuntu-upgrade-linux-image-5-8-0-1033-aws
  • ubuntu-upgrade-linux-image-5-8-0-53-generic
  • ubuntu-upgrade-linux-image-5-8-0-53-generic-64k
  • ubuntu-upgrade-linux-image-5-8-0-53-generic-lpae
  • ubuntu-upgrade-linux-image-5-8-0-53-lowlatency
  • ubuntu-upgrade-linux-image-aws
  • ubuntu-upgrade-linux-image-azure
  • ubuntu-upgrade-linux-image-gcp
  • ubuntu-upgrade-linux-image-generic
  • ubuntu-upgrade-linux-image-generic-64k
  • ubuntu-upgrade-linux-image-generic-64k-hwe-20-04
  • ubuntu-upgrade-linux-image-generic-hwe-20-04
  • ubuntu-upgrade-linux-image-generic-lpae
  • ubuntu-upgrade-linux-image-generic-lpae-hwe-20-04
  • ubuntu-upgrade-linux-image-gke
  • ubuntu-upgrade-linux-image-kvm
  • ubuntu-upgrade-linux-image-lowlatency
  • ubuntu-upgrade-linux-image-lowlatency-hwe-20-04
  • ubuntu-upgrade-linux-image-oem-20-04
  • ubuntu-upgrade-linux-image-oem-20-04b
  • ubuntu-upgrade-linux-image-oracle
  • ubuntu-upgrade-linux-image-raspi
  • ubuntu-upgrade-linux-image-raspi-nolpae
  • ubuntu-upgrade-linux-image-virtual
  • ubuntu-upgrade-linux-image-virtual-hwe-20-04


  • References
  • USN-4948-1
  • USN-4949-1
  • USN-4950-1
  • CVE-2021-3490




  •  

    Copyright © 2020 Cyber Details - Vulnerability Database™

    Thanks for everything Templateism - You should have written the code a little more complicated