CentOS Errata and Security Advisory 2020:5408 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2020:5408
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
5ba93bb7af0fa5612cec66a27e5736fb8c5460ccfc0e32ff2e9e8c97c2587a3f xorg-x11-server-common-1.20.4-15.el7_9.x86_64.rpm
8300c30550c66d4567d56de5063d79d5818aea066707cfcf6638dd2811bd74fc xorg-x11-server-devel-1.20.4-15.el7_9.i686.rpm
40a441051ed2bb80ba7bf16effb6ef562dc02cffbcb40be34952dcdc20a3b66c xorg-x11-server-devel-1.20.4-15.el7_9.x86_64.rpm
bb3864015d5c6e8d0e5f6d4ad1683af99c0b275dcf2efcaee1e4aebf6d78082d xorg-x11-server-source-1.20.4-15.el7_9.noarch.rpm
375dc1e4e253dad77a1c726888c330f2d32bfac978fb2501318c810a4fb93843 xorg-x11-server-Xdmx-1.20.4-15.el7_9.x86_64.rpm
fc23786485123d8fc0e167c65ecee809b1c1047c61cea465e243cf4b64b2a78e xorg-x11-server-Xephyr-1.20.4-15.el7_9.x86_64.rpm
a79594486e59ec5b826e79499c455a6d627baff4bdc3f3df763e5018309b5f9c xorg-x11-server-Xnest-1.20.4-15.el7_9.x86_64.rpm
38116fc986dbde5d1071bccc99bf83579d9cf9cfe210af409971b02a8225df2e xorg-x11-server-Xorg-1.20.4-15.el7_9.x86_64.rpm
27534a1920262b79fa35a9509e192cd19a2916bb7b11d0db13f71ae7cff375a9 xorg-x11-server-Xvfb-1.20.4-15.el7_9.x86_64.rpm
b0d7b591888b6fd49b457c15fa981112edaa1d269c881960174a8676102cad81 xorg-x11-server-Xwayland-1.20.4-15.el7_9.x86_64.rpm
Source:
aa1a835131bbf66abfd0409afc8d8cf66e6ae6e5c446c0aa7c773d037b730a41 xorg-x11-server-1.20.4-15.el7_9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Saturday, February 27, 2021
[CentOS-announce] CESA-2020:5402 Important CentOS 7 libexif Security Update
CentOS Errata and Security Advisory 2020:5402 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2020:5402
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
3bb0da4f1c883b5aaa0ad687bcc2022ba9573d912ff906b6657bc7e96676c5d9 libexif-0.6.22-2.el7_9.i686.rpm
49776569805f34f9417a664fb394e7bff8444fee386100309ce6306cba1c8b1a libexif-0.6.22-2.el7_9.x86_64.rpm
6dafcb9ecc7ca14a4ae5417e71c1fee10a7213e0ebf3d3750cbd23a8cacf5eef libexif-devel-0.6.22-2.el7_9.i686.rpm
618179611cd44ba685db172d3afd1dc0248e66533a35b8e46cdf118d812340d3 libexif-devel-0.6.22-2.el7_9.x86_64.rpm
0c9cd97e333e5ea85907e92483ef91dbdb08349b7e29916dcf5c08061c74f836 libexif-doc-0.6.22-2.el7_9.x86_64.rpm
Source:
3729ce39ae2b4b5ca93513cb15046a4b55ada0662f3ee6888927e6caad3f5709 libexif-0.6.22-2.el7_9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2020:5402
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
3bb0da4f1c883b5aaa0ad687bcc2022ba9573d912ff906b6657bc7e96676c5d9 libexif-0.6.22-2.el7_9.i686.rpm
49776569805f34f9417a664fb394e7bff8444fee386100309ce6306cba1c8b1a libexif-0.6.22-2.el7_9.x86_64.rpm
6dafcb9ecc7ca14a4ae5417e71c1fee10a7213e0ebf3d3750cbd23a8cacf5eef libexif-devel-0.6.22-2.el7_9.i686.rpm
618179611cd44ba685db172d3afd1dc0248e66533a35b8e46cdf118d812340d3 libexif-devel-0.6.22-2.el7_9.x86_64.rpm
0c9cd97e333e5ea85907e92483ef91dbdb08349b7e29916dcf5c08061c74f836 libexif-doc-0.6.22-2.el7_9.x86_64.rpm
Source:
3729ce39ae2b4b5ca93513cb15046a4b55ada0662f3ee6888927e6caad3f5709 libexif-0.6.22-2.el7_9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEBA-2021:0623 CentOS 7 microcode_ctl BugFix Update
CentOS Errata and Bugfix Advisory 2021:0623
Upstream details at : https://access.redhat.com/errata/RHBA-2021:0623
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
0cf6bb4e5beb49f3a45a5171babb25685cf72156e8666dc2a57f9fef6af67838 microcode_ctl-2.1-73.8.el7_9.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHBA-2021:0623
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
0cf6bb4e5beb49f3a45a5171babb25685cf72156e8666dc2a57f9fef6af67838 microcode_ctl-2.1-73.8.el7_9.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Friday, February 26, 2021
[announce] Next NYC*Bug: March 3rd Gaming on OpenBSD: Pearls, Pitfalls, Paranoia
The Next NYC*Bug Zoom meeting will be held March 3rd 18:45 EST / 23:45 UTC
Gaming on OpenBSD: Pearls, Pitfalls, Paranoia, by Thomas Frohwein
OpenBSD has had a long-standing reputation for its security focus, but
is also surprisingly good as a desktop OS once you've made it past the
initial barriers. It hasn't been known for gaming (other than
tetris(6)), leading users to play on other platforms like a Windows
box or game consoles. But now, things are changing one
emulator|sourceport|game engine at a time.
Follow thfr@ on a years-long journey to try to extend the advantages
offered by OpenBSD to more and better gaming - from hardware support
to security mitigations at play, to ultimately overcoming multiple
barriers and growing both OpenBSD's gaming library and its gaming
community.
For Zoom meeting details, email to rsvp AT lists.nycbug.org, and
details will be sent on the day of the meeting.
Speaker Biography
Thomas Frohwein is a German expat living in Montana. He has been
OpenBSD user since 2014, and developer (thfr@) since 2018. His primary
focus has been improving gaming options on OpenBSD and he maintains
the (eternally unfinished) webpage playonbsd.com with the infamous
shopping guide in an attempt to sabotage the productivity of OpenBSD
hackers and tempt them to drain their notoriously low bank accounts.
His dayjob is working as a physician which in this day and age is
almost equivalent to being an IT specialist.
More Info and Zoom invite details:
https://www.nycbug.org/index?action=view&id=10681
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org:8080/mailman/listinfo/announce
Gaming on OpenBSD: Pearls, Pitfalls, Paranoia, by Thomas Frohwein
OpenBSD has had a long-standing reputation for its security focus, but
is also surprisingly good as a desktop OS once you've made it past the
initial barriers. It hasn't been known for gaming (other than
tetris(6)), leading users to play on other platforms like a Windows
box or game consoles. But now, things are changing one
emulator|sourceport|game engine at a time.
Follow thfr@ on a years-long journey to try to extend the advantages
offered by OpenBSD to more and better gaming - from hardware support
to security mitigations at play, to ultimately overcoming multiple
barriers and growing both OpenBSD's gaming library and its gaming
community.
For Zoom meeting details, email to rsvp AT lists.nycbug.org, and
details will be sent on the day of the meeting.
Speaker Biography
Thomas Frohwein is a German expat living in Montana. He has been
OpenBSD user since 2014, and developer (thfr@) since 2018. His primary
focus has been improving gaming options on OpenBSD and he maintains
the (eternally unfinished) webpage playonbsd.com with the infamous
shopping guide in an attempt to sabotage the productivity of OpenBSD
hackers and tempt them to drain their notoriously low bank accounts.
His dayjob is working as a physician which in this day and age is
almost equivalent to being an IT specialist.
More Info and Zoom invite details:
https://www.nycbug.org/index?action=view&id=10681
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org:8080/mailman/listinfo/announce
Thursday, February 25, 2021
[USN-4754-2] Python regression
==========================================================================
Ubuntu Security Notice USN-4754-2
February 25, 2021
python2.7 regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
USN-4754-1 introduced a regression in Python2.7.
Software Description:
- python2.7: An interactive high-level object-oriented language
Details:
USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a
regression in Python 2.7. This update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
python2.7 2.7.17-1~18.04ubuntu1.5
python2.7-minimal 2.7.17-1~18.04ubuntu1.5
Ubuntu 16.04 LTS:
python2.7 2.7.12-1ubuntu0~16.04.16
python2.7-minimal 2.7.12-1ubuntu0~16.04.16
Ubuntu 14.04 ESM:
python2.7 2.7.6-8ubuntu0.6+esm9
python2.7-minimal 2.7.6-8ubuntu0.6+esm9
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4754-2
https://usn.ubuntu.com/4754-1
https://launchpad.net/bugs/1916893
Package Information:
https://launchpad.net/ubuntu/+source/python2.7/2.7.17-1~18.04ubuntu1.5
https://launchpad.net/ubuntu/+source/python2.7/2.7.12-1ubuntu0~16.04.16
Ubuntu Security Notice USN-4754-2
February 25, 2021
python2.7 regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
USN-4754-1 introduced a regression in Python2.7.
Software Description:
- python2.7: An interactive high-level object-oriented language
Details:
USN-4754-1 fixed a vulnerability in Python. The fix for CVE-2021-3177 introduced a
regression in Python 2.7. This update reverts the security fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
python2.7 2.7.17-1~18.04ubuntu1.5
python2.7-minimal 2.7.17-1~18.04ubuntu1.5
Ubuntu 16.04 LTS:
python2.7 2.7.12-1ubuntu0~16.04.16
python2.7-minimal 2.7.12-1ubuntu0~16.04.16
Ubuntu 14.04 ESM:
python2.7 2.7.6-8ubuntu0.6+esm9
python2.7-minimal 2.7.6-8ubuntu0.6+esm9
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4754-2
https://usn.ubuntu.com/4754-1
https://launchpad.net/bugs/1916893
Package Information:
https://launchpad.net/ubuntu/+source/python2.7/2.7.17-1~18.04ubuntu1.5
https://launchpad.net/ubuntu/+source/python2.7/2.7.12-1ubuntu0~16.04.16
[USN-4755-1] LibTIFF vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4755-1
February 25, 2021
tiff vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in LibTIFF.
Software Description:
- tiff: Tag Image File Format (TIFF) library
Details:
It was discovered that LibTIFF incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a specially
crafted image, a remote attacker could crash the application, leading to a
denial of service, or possibly execute arbitrary code with user privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
libtiff-tools 4.1.0+git191117-2ubuntu0.20.10.1
libtiff5 4.1.0+git191117-2ubuntu0.20.10.1
Ubuntu 20.04 LTS:
libtiff-tools 4.1.0+git191117-2ubuntu0.20.04.1
libtiff5 4.1.0+git191117-2ubuntu0.20.04.1
Ubuntu 18.04 LTS:
libtiff-tools 4.0.9-5ubuntu0.4
libtiff5 4.0.9-5ubuntu0.4
Ubuntu 16.04 LTS:
libtiff-tools 4.0.6-1ubuntu0.8
libtiff5 4.0.6-1ubuntu0.8
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4755-1
CVE-2020-35523, CVE-2020-35524
Package Information:
https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/tiff/4.0.9-5ubuntu0.4
https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.8
Ubuntu Security Notice USN-4755-1
February 25, 2021
tiff vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in LibTIFF.
Software Description:
- tiff: Tag Image File Format (TIFF) library
Details:
It was discovered that LibTIFF incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a specially
crafted image, a remote attacker could crash the application, leading to a
denial of service, or possibly execute arbitrary code with user privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
libtiff-tools 4.1.0+git191117-2ubuntu0.20.10.1
libtiff5 4.1.0+git191117-2ubuntu0.20.10.1
Ubuntu 20.04 LTS:
libtiff-tools 4.1.0+git191117-2ubuntu0.20.04.1
libtiff5 4.1.0+git191117-2ubuntu0.20.04.1
Ubuntu 18.04 LTS:
libtiff-tools 4.0.9-5ubuntu0.4
libtiff5 4.0.9-5ubuntu0.4
Ubuntu 16.04 LTS:
libtiff-tools 4.0.6-1ubuntu0.8
libtiff5 4.0.6-1ubuntu0.8
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4755-1
CVE-2020-35523, CVE-2020-35524
Package Information:
https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/tiff/4.0.9-5ubuntu0.4
https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.8
[USN-4754-1] Python vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4754-1
February 25, 2021
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Python could be made to execute arbitrary code or denial of service if it
received a specially crafted input.
Software Description:
- python3.8: Interactive high-level object-oriented language (version 3.8)
- python2.7: An interactive high-level object-oriented language
- python3.6: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language
- python3.4: An interactive high-level object-oriented language
Details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
python3.8 3.8.6-1ubuntu0.2
python3.8-minimal 3.8.6-1ubuntu0.2
Ubuntu 20.04 LTS:
python3.8 3.8.5-1~20.04.2
python3.8-minimal 3.8.5-1~20.04.2
Ubuntu 18.04 LTS:
python2.7 2.7.17-1~18.04ubuntu1.3
python2.7-minimal 2.7.17-1~18.04ubuntu1.3
python3.6 3.6.9-1~18.04ubuntu1.4
python3.6-minimal 3.6.9-1~18.04ubuntu1.4
Ubuntu 16.04 LTS:
python2.7 2.7.12-1ubuntu0~16.04.14
python2.7-minimal 2.7.12-1ubuntu0~16.04.14
python3.5 3.5.2-2ubuntu0~16.04.13
python3.5-minimal 3.5.2-2ubuntu0~16.04.13
Ubuntu 14.04 ESM:
python2.7 2.7.6-8ubuntu0.6+esm8
python2.7-minimal 2.7.6-8ubuntu0.6+esm8
python3.4 3.4.3-1ubuntu1~14.04.7+esm10
python3.4-minimal 3.4.3-1ubuntu1~14.04.7+esm10
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4754-1
CVE-2020-27619, CVE-2021-3177
Package Information:
https://launchpad.net/ubuntu/+source/python3.8/3.8.6-1ubuntu0.2
https://launchpad.net/ubuntu/+source/python3.8/3.8.5-1~20.04.2
https://launchpad.net/ubuntu/+source/python2.7/2.7.17-1~18.04ubuntu1.3
https://launchpad.net/ubuntu/+source/python3.6/3.6.9-1~18.04ubuntu1.4
https://launchpad.net/ubuntu/+source/python2.7/2.7.12-1ubuntu0~16.04.14
https://launchpad.net/ubuntu/+source/python3.5/3.5.2-2ubuntu0~16.04.13
Ubuntu Security Notice USN-4754-1
February 25, 2021
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Python could be made to execute arbitrary code or denial of service if it
received a specially crafted input.
Software Description:
- python3.8: Interactive high-level object-oriented language (version 3.8)
- python2.7: An interactive high-level object-oriented language
- python3.6: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language
- python3.4: An interactive high-level object-oriented language
Details:
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
python3.8 3.8.6-1ubuntu0.2
python3.8-minimal 3.8.6-1ubuntu0.2
Ubuntu 20.04 LTS:
python3.8 3.8.5-1~20.04.2
python3.8-minimal 3.8.5-1~20.04.2
Ubuntu 18.04 LTS:
python2.7 2.7.17-1~18.04ubuntu1.3
python2.7-minimal 2.7.17-1~18.04ubuntu1.3
python3.6 3.6.9-1~18.04ubuntu1.4
python3.6-minimal 3.6.9-1~18.04ubuntu1.4
Ubuntu 16.04 LTS:
python2.7 2.7.12-1ubuntu0~16.04.14
python2.7-minimal 2.7.12-1ubuntu0~16.04.14
python3.5 3.5.2-2ubuntu0~16.04.13
python3.5-minimal 3.5.2-2ubuntu0~16.04.13
Ubuntu 14.04 ESM:
python2.7 2.7.6-8ubuntu0.6+esm8
python2.7-minimal 2.7.6-8ubuntu0.6+esm8
python3.4 3.4.3-1ubuntu1~14.04.7+esm10
python3.4-minimal 3.4.3-1ubuntu1~14.04.7+esm10
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4754-1
CVE-2020-27619, CVE-2021-3177
Package Information:
https://launchpad.net/ubuntu/+source/python3.8/3.8.6-1ubuntu0.2
https://launchpad.net/ubuntu/+source/python3.8/3.8.5-1~20.04.2
https://launchpad.net/ubuntu/+source/python2.7/2.7.17-1~18.04ubuntu1.3
https://launchpad.net/ubuntu/+source/python3.6/3.6.9-1~18.04ubuntu1.4
https://launchpad.net/ubuntu/+source/python2.7/2.7.12-1ubuntu0~16.04.14
https://launchpad.net/ubuntu/+source/python3.5/3.5.2-2ubuntu0~16.04.13
[USN-4751-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4751-1
February 25, 2021
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm,
linux-oracle, linux-raspi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi (V8) systems
- linux-hwe-5.8: Linux hardware enablement (HWE) kernel
Details:
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2020-25704)
Julien Grall discovered that the Xen dom0 event handler in the Linux kernel
did not properly limit the number of events queued. An attacker in a guest
VM could use this to cause a denial of service in the host OS.
(CVE-2020-27673)
Jinoh Kang discovered that the Xen event channel infrastructure in the
Linux kernel contained a race condition. An attacker in guest could
possibly use this to cause a denial of service (dom0 crash).
(CVE-2020-27675)
Daniel Axtens discovered that PowerPC RTAS implementation in the Linux
kernel did not properly restrict memory accesses in some situations. A
privileged local attacker could use this to arbitrarily modify kernel
memory, potentially bypassing kernel lockdown restrictions.
(CVE-2020-27777)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that a use-after-free vulnerability existed in the
infiniband hfi1 device driver in the Linux kernel. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2020-27835)
It was discovered that an information leak existed in the syscall
implementation in the Linux kernel on 32 bit systems. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2020-28588)
Minh Yuan discovered that the framebuffer console driver in the Linux
kernel did not properly handle fonts in some conditions. A local attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information (kernel memory). (CVE-2020-28974)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the
Xen paravirt block backend in the Linux kernel, leading to a use-after-free
vulnerability. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
It was discovered that a race condition existed that caused the Linux
kernel to not properly restrict exit signal delivery. A local attacker
could possibly use this to send signals to arbitrary processes.
(CVE-2020-35508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
linux-image-5.8.0-1016-raspi 5.8.0-1016.19
linux-image-5.8.0-1016-raspi-nolpae 5.8.0-1016.19
linux-image-5.8.0-1019-kvm 5.8.0-1019.21
linux-image-5.8.0-1021-oracle 5.8.0-1021.22
linux-image-5.8.0-1023-azure 5.8.0-1023.25
linux-image-5.8.0-1023-gcp 5.8.0-1023.24
linux-image-5.8.0-1024-aws 5.8.0-1024.26
linux-image-5.8.0-44-generic 5.8.0-44.50
linux-image-5.8.0-44-generic-64k 5.8.0-44.50
linux-image-5.8.0-44-generic-lpae 5.8.0-44.50
linux-image-5.8.0-44-lowlatency 5.8.0-44.50
linux-image-aws 5.8.0.1024.26
linux-image-azure 5.8.0.1023.23
linux-image-gcp 5.8.0.1023.23
linux-image-generic 5.8.0.44.49
linux-image-generic-64k 5.8.0.44.49
linux-image-generic-lpae 5.8.0.44.49
linux-image-gke 5.8.0.1023.23
linux-image-kvm 5.8.0.1019.21
linux-image-lowlatency 5.8.0.44.49
linux-image-oem-20.04 5.8.0.44.49
linux-image-oracle 5.8.0.1021.20
linux-image-raspi 5.8.0.1016.19
linux-image-raspi-nolpae 5.8.0.1016.19
linux-image-virtual 5.8.0.44.49
Ubuntu 20.04 LTS:
linux-image-5.8.0-44-generic 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-generic-lpae 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-lowlatency 5.8.0-44.50~20.04.1
linux-image-generic-64k-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-generic-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-generic-lpae-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-lowlatency-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-virtual-hwe-20.04 5.8.0.44.50~20.04.30
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4751-1
CVE-2020-25656, CVE-2020-25668, CVE-2020-25669, CVE-2020-25704,
CVE-2020-27673, CVE-2020-27675, CVE-2020-27777, CVE-2020-27815,
CVE-2020-27830, CVE-2020-27835, CVE-2020-28588, CVE-2020-28941,
CVE-2020-28974, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660,
CVE-2020-29661, CVE-2020-35508
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.8.0-44.50
https://launchpad.net/ubuntu/+source/linux-aws/5.8.0-1024.26
https://launchpad.net/ubuntu/+source/linux-azure/5.8.0-1023.25
https://launchpad.net/ubuntu/+source/linux-gcp/5.8.0-1023.24
https://launchpad.net/ubuntu/+source/linux-kvm/5.8.0-1019.21
https://launchpad.net/ubuntu/+source/linux-oracle/5.8.0-1021.22
https://launchpad.net/ubuntu/+source/linux-raspi/5.8.0-1016.19
https://launchpad.net/ubuntu/+source/linux-hwe-5.8/5.8.0-44.50~20.04.1
Ubuntu Security Notice USN-4751-1
February 25, 2021
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm,
linux-oracle, linux-raspi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi (V8) systems
- linux-hwe-5.8: Linux hardware enablement (HWE) kernel
Details:
It was discovered that the console keyboard driver in the Linux kernel
contained a race condition. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-25656)
Minh Yuan discovered that the tty driver in the Linux kernel contained race
conditions when handling fonts. A local attacker could possibly use this to
expose sensitive information (kernel memory). (CVE-2020-25668)
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2020-25704)
Julien Grall discovered that the Xen dom0 event handler in the Linux kernel
did not properly limit the number of events queued. An attacker in a guest
VM could use this to cause a denial of service in the host OS.
(CVE-2020-27673)
Jinoh Kang discovered that the Xen event channel infrastructure in the
Linux kernel contained a race condition. An attacker in guest could
possibly use this to cause a denial of service (dom0 crash).
(CVE-2020-27675)
Daniel Axtens discovered that PowerPC RTAS implementation in the Linux
kernel did not properly restrict memory accesses in some situations. A
privileged local attacker could use this to arbitrarily modify kernel
memory, potentially bypassing kernel lockdown restrictions.
(CVE-2020-27777)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that a use-after-free vulnerability existed in the
infiniband hfi1 device driver in the Linux kernel. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2020-27835)
It was discovered that an information leak existed in the syscall
implementation in the Linux kernel on 32 bit systems. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2020-28588)
Minh Yuan discovered that the framebuffer console driver in the Linux
kernel did not properly handle fonts in some conditions. A local attacker
could use this to cause a denial of service (system crash) or possibly
expose sensitive information (kernel memory). (CVE-2020-28974)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the
Xen paravirt block backend in the Linux kernel, leading to a use-after-free
vulnerability. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
It was discovered that a race condition existed that caused the Linux
kernel to not properly restrict exit signal delivery. A local attacker
could possibly use this to send signals to arbitrary processes.
(CVE-2020-35508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
linux-image-5.8.0-1016-raspi 5.8.0-1016.19
linux-image-5.8.0-1016-raspi-nolpae 5.8.0-1016.19
linux-image-5.8.0-1019-kvm 5.8.0-1019.21
linux-image-5.8.0-1021-oracle 5.8.0-1021.22
linux-image-5.8.0-1023-azure 5.8.0-1023.25
linux-image-5.8.0-1023-gcp 5.8.0-1023.24
linux-image-5.8.0-1024-aws 5.8.0-1024.26
linux-image-5.8.0-44-generic 5.8.0-44.50
linux-image-5.8.0-44-generic-64k 5.8.0-44.50
linux-image-5.8.0-44-generic-lpae 5.8.0-44.50
linux-image-5.8.0-44-lowlatency 5.8.0-44.50
linux-image-aws 5.8.0.1024.26
linux-image-azure 5.8.0.1023.23
linux-image-gcp 5.8.0.1023.23
linux-image-generic 5.8.0.44.49
linux-image-generic-64k 5.8.0.44.49
linux-image-generic-lpae 5.8.0.44.49
linux-image-gke 5.8.0.1023.23
linux-image-kvm 5.8.0.1019.21
linux-image-lowlatency 5.8.0.44.49
linux-image-oem-20.04 5.8.0.44.49
linux-image-oracle 5.8.0.1021.20
linux-image-raspi 5.8.0.1016.19
linux-image-raspi-nolpae 5.8.0.1016.19
linux-image-virtual 5.8.0.44.49
Ubuntu 20.04 LTS:
linux-image-5.8.0-44-generic 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-generic-lpae 5.8.0-44.50~20.04.1
linux-image-5.8.0-44-lowlatency 5.8.0-44.50~20.04.1
linux-image-generic-64k-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-generic-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-generic-lpae-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-lowlatency-hwe-20.04 5.8.0.44.50~20.04.30
linux-image-virtual-hwe-20.04 5.8.0.44.50~20.04.30
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4751-1
CVE-2020-25656, CVE-2020-25668, CVE-2020-25669, CVE-2020-25704,
CVE-2020-27673, CVE-2020-27675, CVE-2020-27777, CVE-2020-27815,
CVE-2020-27830, CVE-2020-27835, CVE-2020-28588, CVE-2020-28941,
CVE-2020-28974, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660,
CVE-2020-29661, CVE-2020-35508
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.8.0-44.50
https://launchpad.net/ubuntu/+source/linux-aws/5.8.0-1024.26
https://launchpad.net/ubuntu/+source/linux-azure/5.8.0-1023.25
https://launchpad.net/ubuntu/+source/linux-gcp/5.8.0-1023.24
https://launchpad.net/ubuntu/+source/linux-kvm/5.8.0-1019.21
https://launchpad.net/ubuntu/+source/linux-oracle/5.8.0-1021.22
https://launchpad.net/ubuntu/+source/linux-raspi/5.8.0-1016.19
https://launchpad.net/ubuntu/+source/linux-hwe-5.8/5.8.0-44.50~20.04.1
[USN-4750-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4750-1
February 25, 2021
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp,
linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4,
linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi (V8) systems
- linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems
- linux-gcp-5.4: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-5.4: Linux kernel for Google Container Engine (GKE) systems
- linux-gkeop-5.4: Linux kernel for Google Container Engine (GKE) systems
- linux-hwe-5.4: Linux hardware enablement (HWE) kernel
- linux-oracle-5.4: Linux kernel for Oracle Cloud systems
- linux-raspi-5.4: Linux kernel for Raspberry Pi (V8) systems
Details:
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that an information leak existed in the syscall
implementation in the Linux kernel on 32 bit systems. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2020-28588)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the
Xen paravirt block backend in the Linux kernel, leading to a use-after-free
vulnerability. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly handle filter rules in some situations. A local attacker with the
CAP_NET_ADMIN capability could use this to cause a denial of service.
(CVE-2021-20177)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1010-gkeop 5.4.0-1010.11
linux-image-5.4.0-1029-raspi 5.4.0-1029.32
linux-image-5.4.0-1033-kvm 5.4.0-1033.34
linux-image-5.4.0-1037-gcp 5.4.0-1037.40
linux-image-5.4.0-1038-aws 5.4.0-1038.40
linux-image-5.4.0-1038-oracle 5.4.0-1038.41
linux-image-5.4.0-1040-azure 5.4.0-1040.42
linux-image-5.4.0-66-generic 5.4.0-66.74
linux-image-5.4.0-66-generic-lpae 5.4.0-66.74
linux-image-5.4.0-66-lowlatency 5.4.0-66.74
linux-image-aws 5.4.0.1038.39
linux-image-azure 5.4.0.1040.38
linux-image-gcp 5.4.0.1037.46
linux-image-generic 5.4.0.66.69
linux-image-generic-lpae 5.4.0.66.69
linux-image-gkeop 5.4.0.1010.13
linux-image-gkeop-5.4 5.4.0.1010.13
linux-image-kvm 5.4.0.1033.31
linux-image-lowlatency 5.4.0.66.69
linux-image-oem 5.4.0.66.69
linux-image-oem-osp1 5.4.0.66.69
linux-image-oracle 5.4.0.1038.35
linux-image-raspi 5.4.0.1029.64
linux-image-raspi2 5.4.0.1029.64
linux-image-virtual 5.4.0.66.69
Ubuntu 18.04 LTS:
linux-image-5.4.0-1010-gkeop 5.4.0-1010.11~18.04.1
linux-image-5.4.0-1029-raspi 5.4.0-1029.32~18.04.1
linux-image-5.4.0-1036-gke 5.4.0-1036.38~18.04.1
linux-image-5.4.0-1037-gcp 5.4.0-1037.40~18.04.1
linux-image-5.4.0-1038-aws 5.4.0-1038.40~18.04.1
linux-image-5.4.0-1038-oracle 5.4.0-1038.41~18.04.1
linux-image-5.4.0-1040-azure 5.4.0-1040.42~18.04.1
linux-image-5.4.0-66-generic 5.4.0-66.74~18.04.2
linux-image-5.4.0-66-generic-lpae 5.4.0-66.74~18.04.2
linux-image-5.4.0-66-lowlatency 5.4.0-66.74~18.04.2
linux-image-aws 5.4.0.1038.22
linux-image-azure 5.4.0.1040.20
linux-image-gcp 5.4.0.1037.24
linux-image-generic-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-generic-lpae-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-gke-5.4 5.4.0.1036.38~18.04.4
linux-image-gkeop-5.4 5.4.0.1010.11~18.04.11
linux-image-lowlatency-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-oem 5.4.0.66.74~18.04.61
linux-image-oem-osp1 5.4.0.66.74~18.04.61
linux-image-oracle 5.4.0.1038.41~18.04.21
linux-image-raspi-hwe-18.04 5.4.0.1029.32
linux-image-snapdragon-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-virtual-hwe-18.04 5.4.0.66.74~18.04.61
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4750-1
CVE-2020-25669, CVE-2020-27815, CVE-2020-27830, CVE-2020-28588,
CVE-2020-28941, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660,
CVE-2020-29661, CVE-2021-20177
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.4.0-66.74
https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1038.40
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1040.42
https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1037.40
https://launchpad.net/ubuntu/+source/linux-gkeop/5.4.0-1010.11
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1033.34
https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1038.41
https://launchpad.net/ubuntu/+source/linux-raspi/5.4.0-1029.32
https://launchpad.net/ubuntu/+source/linux-aws-5.4/5.4.0-1038.40~18.04.1
https://launchpad.net/ubuntu/+source/linux-azure-5.4/5.4.0-1040.42~18.04.1
https://launchpad.net/ubuntu/+source/linux-gcp-5.4/5.4.0-1037.40~18.04.1
https://launchpad.net/ubuntu/+source/linux-gke-5.4/5.4.0-1036.38~18.04.1
https://launchpad.net/ubuntu/+source/linux-gkeop-5.4/5.4.0-1010.11~18.04.1
https://launchpad.net/ubuntu/+source/linux-hwe-5.4/5.4.0-66.74~18.04.2
https://launchpad.net/ubuntu/+source/linux-oracle-5.4/5.4.0-1038.41~18.04.1
https://launchpad.net/ubuntu/+source/linux-raspi-5.4/5.4.0-1029.32~18.04.1
Ubuntu Security Notice USN-4750-1
February 25, 2021
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp,
linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4,
linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi (V8) systems
- linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems
- linux-gcp-5.4: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-5.4: Linux kernel for Google Container Engine (GKE) systems
- linux-gkeop-5.4: Linux kernel for Google Container Engine (GKE) systems
- linux-hwe-5.4: Linux hardware enablement (HWE) kernel
- linux-oracle-5.4: Linux kernel for Oracle Cloud systems
- linux-raspi-5.4: Linux kernel for Raspberry Pi (V8) systems
Details:
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that an information leak existed in the syscall
implementation in the Linux kernel on 32 bit systems. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2020-28588)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the
Xen paravirt block backend in the Linux kernel, leading to a use-after-free
vulnerability. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly handle filter rules in some situations. A local attacker with the
CAP_NET_ADMIN capability could use this to cause a denial of service.
(CVE-2021-20177)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1010-gkeop 5.4.0-1010.11
linux-image-5.4.0-1029-raspi 5.4.0-1029.32
linux-image-5.4.0-1033-kvm 5.4.0-1033.34
linux-image-5.4.0-1037-gcp 5.4.0-1037.40
linux-image-5.4.0-1038-aws 5.4.0-1038.40
linux-image-5.4.0-1038-oracle 5.4.0-1038.41
linux-image-5.4.0-1040-azure 5.4.0-1040.42
linux-image-5.4.0-66-generic 5.4.0-66.74
linux-image-5.4.0-66-generic-lpae 5.4.0-66.74
linux-image-5.4.0-66-lowlatency 5.4.0-66.74
linux-image-aws 5.4.0.1038.39
linux-image-azure 5.4.0.1040.38
linux-image-gcp 5.4.0.1037.46
linux-image-generic 5.4.0.66.69
linux-image-generic-lpae 5.4.0.66.69
linux-image-gkeop 5.4.0.1010.13
linux-image-gkeop-5.4 5.4.0.1010.13
linux-image-kvm 5.4.0.1033.31
linux-image-lowlatency 5.4.0.66.69
linux-image-oem 5.4.0.66.69
linux-image-oem-osp1 5.4.0.66.69
linux-image-oracle 5.4.0.1038.35
linux-image-raspi 5.4.0.1029.64
linux-image-raspi2 5.4.0.1029.64
linux-image-virtual 5.4.0.66.69
Ubuntu 18.04 LTS:
linux-image-5.4.0-1010-gkeop 5.4.0-1010.11~18.04.1
linux-image-5.4.0-1029-raspi 5.4.0-1029.32~18.04.1
linux-image-5.4.0-1036-gke 5.4.0-1036.38~18.04.1
linux-image-5.4.0-1037-gcp 5.4.0-1037.40~18.04.1
linux-image-5.4.0-1038-aws 5.4.0-1038.40~18.04.1
linux-image-5.4.0-1038-oracle 5.4.0-1038.41~18.04.1
linux-image-5.4.0-1040-azure 5.4.0-1040.42~18.04.1
linux-image-5.4.0-66-generic 5.4.0-66.74~18.04.2
linux-image-5.4.0-66-generic-lpae 5.4.0-66.74~18.04.2
linux-image-5.4.0-66-lowlatency 5.4.0-66.74~18.04.2
linux-image-aws 5.4.0.1038.22
linux-image-azure 5.4.0.1040.20
linux-image-gcp 5.4.0.1037.24
linux-image-generic-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-generic-lpae-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-gke-5.4 5.4.0.1036.38~18.04.4
linux-image-gkeop-5.4 5.4.0.1010.11~18.04.11
linux-image-lowlatency-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-oem 5.4.0.66.74~18.04.61
linux-image-oem-osp1 5.4.0.66.74~18.04.61
linux-image-oracle 5.4.0.1038.41~18.04.21
linux-image-raspi-hwe-18.04 5.4.0.1029.32
linux-image-snapdragon-hwe-18.04 5.4.0.66.74~18.04.61
linux-image-virtual-hwe-18.04 5.4.0.66.74~18.04.61
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4750-1
CVE-2020-25669, CVE-2020-27815, CVE-2020-27830, CVE-2020-28588,
CVE-2020-28941, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660,
CVE-2020-29661, CVE-2021-20177
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.4.0-66.74
https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1038.40
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1040.42
https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1037.40
https://launchpad.net/ubuntu/+source/linux-gkeop/5.4.0-1010.11
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1033.34
https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1038.41
https://launchpad.net/ubuntu/+source/linux-raspi/5.4.0-1029.32
https://launchpad.net/ubuntu/+source/linux-aws-5.4/5.4.0-1038.40~18.04.1
https://launchpad.net/ubuntu/+source/linux-azure-5.4/5.4.0-1040.42~18.04.1
https://launchpad.net/ubuntu/+source/linux-gcp-5.4/5.4.0-1037.40~18.04.1
https://launchpad.net/ubuntu/+source/linux-gke-5.4/5.4.0-1036.38~18.04.1
https://launchpad.net/ubuntu/+source/linux-gkeop-5.4/5.4.0-1010.11~18.04.1
https://launchpad.net/ubuntu/+source/linux-hwe-5.4/5.4.0-66.74~18.04.2
https://launchpad.net/ubuntu/+source/linux-oracle-5.4/5.4.0-1038.41~18.04.1
https://launchpad.net/ubuntu/+source/linux-raspi-5.4/5.4.0-1029.32~18.04.1
[USN-4752-1] Linux kernel (OEM) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4752-1
February 25, 2021
linux-oem-5.6 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-oem-5.6: Linux kernel for OEM systems
Details:
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
It was discovered that the block layer implementation in the Linux kernel
did not properly perform reference counting in some situations, leading to
a use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash). (CVE-2020-15436)
It was discovered that the serial port driver in the Linux kernel did not
properly initialize a pointer in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2020-15437)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-based buffer overflow. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-24490)
It was discovered that the NFS client implementation in the Linux kernel
did not properly perform bounds checking before copying security labels in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that the block layer subsystem in the Linux kernel did
not properly handle zero-length requests. A local attacker could use this
to cause a denial of service. (CVE-2020-25641)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2020-25704)
It was discovered that the KVM hypervisor in the Linux kernel did not
properly handle interrupts in certain situations. A local attacker in a
guest VM could possibly use this to cause a denial of service (host system
crash). (CVE-2020-27152)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
It was discovered that an information leak existed in the syscall
implementation in the Linux kernel on 32 bit systems. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2020-28588)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
Jann Horn discovered a race condition in the copy-on-write implementation
in the Linux kernel when handling hugepages. A local attacker could use
this to gain unintended write access to read-only memory pages.
(CVE-2020-29368)
Jann Horn discovered that the mmap implementation in the Linux kernel
contained a race condition when handling munmap() operations, leading to a
read-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly expose sensitive information.
(CVE-2020-29369)
Jann Horn discovered that the romfs file system in the Linux kernel did not
properly validate file system meta-data, leading to an out-of-bounds read.
An attacker could use this to construct a malicious romfs image that, when
mounted, exposed sensitive information (kernel memory). (CVE-2020-29371)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
It was discovered that a race condition existed that caused the Linux
kernel to not properly restrict exit signal delivery. A local attacker
could possibly use this to send signals to arbitrary processes.
(CVE-2020-35508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.6.0-1048-oem 5.6.0-1048.52
linux-image-oem-20.04 5.6.0.1048.44
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4752-1
CVE-2020-10135, CVE-2020-14314, CVE-2020-15436, CVE-2020-15437,
CVE-2020-24490, CVE-2020-25212, CVE-2020-25284, CVE-2020-25641,
CVE-2020-25643, CVE-2020-25704, CVE-2020-27152, CVE-2020-27815,
CVE-2020-28588, CVE-2020-28915, CVE-2020-29368, CVE-2020-29369,
CVE-2020-29371, CVE-2020-29660, CVE-2020-29661, CVE-2020-35508
Package Information:
https://launchpad.net/ubuntu/+source/linux-oem-5.6/5.6.0-1048.52
Ubuntu Security Notice USN-4752-1
February 25, 2021
linux-oem-5.6 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-oem-5.6: Linux kernel for OEM systems
Details:
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered
that legacy pairing and secure-connections pairing authentication in the
Bluetooth protocol could allow an unauthenticated user to complete
authentication without pairing credentials via adjacent access. A
physically proximate attacker could use this to impersonate a previously
paired Bluetooth device. (CVE-2020-10135)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
It was discovered that the block layer implementation in the Linux kernel
did not properly perform reference counting in some situations, leading to
a use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash). (CVE-2020-15436)
It was discovered that the serial port driver in the Linux kernel did not
properly initialize a pointer in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2020-15437)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-based buffer overflow. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-24490)
It was discovered that the NFS client implementation in the Linux kernel
did not properly perform bounds checking before copying security labels in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)
It was discovered that the Rados block device (rbd) driver in the Linux
kernel did not properly perform privilege checks for access to rbd devices
in some situations. A local attacker could use this to map or unmap rbd
block devices. (CVE-2020-25284)
It was discovered that the block layer subsystem in the Linux kernel did
not properly handle zero-length requests. A local attacker could use this
to cause a denial of service. (CVE-2020-25641)
It was discovered that the HDLC PPP implementation in the Linux kernel did
not properly validate input in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2020-25643)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2020-25704)
It was discovered that the KVM hypervisor in the Linux kernel did not
properly handle interrupts in certain situations. A local attacker in a
guest VM could possibly use this to cause a denial of service (host system
crash). (CVE-2020-27152)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
It was discovered that an information leak existed in the syscall
implementation in the Linux kernel on 32 bit systems. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2020-28588)
It was discovered that the framebuffer implementation in the Linux kernel
did not properly perform range checks in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2020-28915)
Jann Horn discovered a race condition in the copy-on-write implementation
in the Linux kernel when handling hugepages. A local attacker could use
this to gain unintended write access to read-only memory pages.
(CVE-2020-29368)
Jann Horn discovered that the mmap implementation in the Linux kernel
contained a race condition when handling munmap() operations, leading to a
read-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly expose sensitive information.
(CVE-2020-29369)
Jann Horn discovered that the romfs file system in the Linux kernel did not
properly validate file system meta-data, leading to an out-of-bounds read.
An attacker could use this to construct a malicious romfs image that, when
mounted, exposed sensitive information (kernel memory). (CVE-2020-29371)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
It was discovered that a race condition existed that caused the Linux
kernel to not properly restrict exit signal delivery. A local attacker
could possibly use this to send signals to arbitrary processes.
(CVE-2020-35508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.6.0-1048-oem 5.6.0-1048.52
linux-image-oem-20.04 5.6.0.1048.44
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4752-1
CVE-2020-10135, CVE-2020-14314, CVE-2020-15436, CVE-2020-15437,
CVE-2020-24490, CVE-2020-25212, CVE-2020-25284, CVE-2020-25641,
CVE-2020-25643, CVE-2020-25704, CVE-2020-27152, CVE-2020-27815,
CVE-2020-28588, CVE-2020-28915, CVE-2020-29368, CVE-2020-29369,
CVE-2020-29371, CVE-2020-29660, CVE-2020-29661, CVE-2020-35508
Package Information:
https://launchpad.net/ubuntu/+source/linux-oem-5.6/5.6.0-1048.52
[USN-4753-1] Linux kernel (OEM) vulnerability
==========================================================================
Ubuntu Security Notice USN-4753-1
February 25, 2021
linux-oem-5.10 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
The system could allow unintended access to data in some environments.
Software Description:
- linux-oem-5.10: Linux kernel for OEM systems
Details:
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.10.0-1014-oem 5.10.0-1014.15
linux-image-oem-20.04b 5.10.0.1014.15
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4753-1
CVE-2020-28374, CVE-2021-3178
Package Information:
https://launchpad.net/ubuntu/+source/linux-oem-5.10/5.10.0-1014.15
Ubuntu Security Notice USN-4753-1
February 25, 2021
linux-oem-5.10 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
The system could allow unintended access to data in some environments.
Software Description:
- linux-oem-5.10: Linux kernel for OEM systems
Details:
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.10.0-1014-oem 5.10.0-1014.15
linux-image-oem-20.04b 5.10.0.1014.15
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4753-1
CVE-2020-28374, CVE-2021-3178
Package Information:
https://launchpad.net/ubuntu/+source/linux-oem-5.10/5.10.0-1014.15
[USN-4749-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4749-1
February 25, 2021
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15,
linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe,
linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-dell300x: Linux kernel for Dell 300x platforms
- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-4.15: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that the memory management subsystem in the Linux kernel
did not properly handle copy-on-write operations in some situations. A
local attacker could possibly use this to gain unintended write access to
read-only memory pages. (CVE-2020-29374)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the
Xen paravirt block backend in the Linux kernel, leading to a use-after-free
vulnerability. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1012-dell300x 4.15.0-1012.16
linux-image-4.15.0-1065-oracle 4.15.0-1065.73
linux-image-4.15.0-1079-gke 4.15.0-1079.84
linux-image-4.15.0-1079-raspi2 4.15.0-1079.84
linux-image-4.15.0-1085-kvm 4.15.0-1085.87
linux-image-4.15.0-1093-gcp 4.15.0-1093.106
linux-image-4.15.0-1094-aws 4.15.0-1094.101
linux-image-4.15.0-1096-snapdragon 4.15.0-1096.105
linux-image-4.15.0-1108-azure 4.15.0-1108.120
linux-image-4.15.0-136-generic 4.15.0-136.140
linux-image-4.15.0-136-generic-lpae 4.15.0-136.140
linux-image-4.15.0-136-lowlatency 4.15.0-136.140
linux-image-aws-lts-18.04 4.15.0.1094.97
linux-image-azure-lts-18.04 4.15.0.1108.81
linux-image-dell300x 4.15.0.1012.14
linux-image-gcp-lts-18.04 4.15.0.1093.111
linux-image-generic 4.15.0.136.123
linux-image-generic-lpae 4.15.0.136.123
linux-image-gke 4.15.0.1079.83
linux-image-gke-4.15 4.15.0.1079.83
linux-image-kvm 4.15.0.1085.81
linux-image-lowlatency 4.15.0.136.123
linux-image-oracle-lts-18.04 4.15.0.1065.75
linux-image-powerpc-e500mc 4.15.0.136.123
linux-image-powerpc-smp 4.15.0.136.123
linux-image-powerpc64-emb 4.15.0.136.123
linux-image-powerpc64-smp 4.15.0.136.123
linux-image-raspi2 4.15.0.1079.76
linux-image-snapdragon 4.15.0.1096.99
linux-image-virtual 4.15.0.136.123
Ubuntu 16.04 LTS:
linux-image-4.15.0-1065-oracle 4.15.0-1065.73~16.04.1
linux-image-4.15.0-1093-gcp 4.15.0-1093.106~16.04.1
linux-image-4.15.0-1094-aws 4.15.0-1094.101~16.04.1
linux-image-4.15.0-1108-azure 4.15.0-1108.120~16.04.1
linux-image-4.15.0-136-generic 4.15.0-136.140~16.04.1
linux-image-4.15.0-136-generic-lpae 4.15.0-136.140~16.04.1
linux-image-4.15.0-136-lowlatency 4.15.0-136.140~16.04.1
linux-image-aws-hwe 4.15.0.1094.87
linux-image-azure 4.15.0.1108.99
linux-image-gcp 4.15.0.1093.94
linux-image-generic-hwe-16.04 4.15.0.136.132
linux-image-generic-lpae-hwe-16.04 4.15.0.136.132
linux-image-gke 4.15.0.1093.94
linux-image-lowlatency-hwe-16.04 4.15.0.136.132
linux-image-oem 4.15.0.136.132
linux-image-oracle 4.15.0.1065.53
linux-image-virtual-hwe-16.04 4.15.0.136.132
Ubuntu 14.04 ESM:
linux-image-4.15.0-1108-azure 4.15.0-1108.120~14.04.1
linux-image-azure 4.15.0.1108.81
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4749-1
CVE-2020-25669, CVE-2020-27815, CVE-2020-27830, CVE-2020-28941,
CVE-2020-29374, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660,
CVE-2020-29661
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-136.140
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1094.101
https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1108.120
https://launchpad.net/ubuntu/+source/linux-dell300x/4.15.0-1012.16
https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1093.106
https://launchpad.net/ubuntu/+source/linux-gke-4.15/4.15.0-1079.84
https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1085.87
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1065.73
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1079.84
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1096.105
https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1094.101~16.04.1
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1108.120~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1093.106~16.04.1
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-136.140~16.04.1
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1065.73~16.04.1
Ubuntu Security Notice USN-4749-1
February 25, 2021
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15,
linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe,
linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-dell300x: Linux kernel for Dell 300x platforms
- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-4.15: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that the memory management subsystem in the Linux kernel
did not properly handle copy-on-write operations in some situations. A
local attacker could possibly use this to gain unintended write access to
read-only memory pages. (CVE-2020-29374)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the
Xen paravirt block backend in the Linux kernel, leading to a use-after-free
vulnerability. An attacker in a guest VM could use this to cause a denial
of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use
consistent locking in some situations, leading to a read-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information (kernel memory).
(CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux
kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after-
free vulnerability. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1012-dell300x 4.15.0-1012.16
linux-image-4.15.0-1065-oracle 4.15.0-1065.73
linux-image-4.15.0-1079-gke 4.15.0-1079.84
linux-image-4.15.0-1079-raspi2 4.15.0-1079.84
linux-image-4.15.0-1085-kvm 4.15.0-1085.87
linux-image-4.15.0-1093-gcp 4.15.0-1093.106
linux-image-4.15.0-1094-aws 4.15.0-1094.101
linux-image-4.15.0-1096-snapdragon 4.15.0-1096.105
linux-image-4.15.0-1108-azure 4.15.0-1108.120
linux-image-4.15.0-136-generic 4.15.0-136.140
linux-image-4.15.0-136-generic-lpae 4.15.0-136.140
linux-image-4.15.0-136-lowlatency 4.15.0-136.140
linux-image-aws-lts-18.04 4.15.0.1094.97
linux-image-azure-lts-18.04 4.15.0.1108.81
linux-image-dell300x 4.15.0.1012.14
linux-image-gcp-lts-18.04 4.15.0.1093.111
linux-image-generic 4.15.0.136.123
linux-image-generic-lpae 4.15.0.136.123
linux-image-gke 4.15.0.1079.83
linux-image-gke-4.15 4.15.0.1079.83
linux-image-kvm 4.15.0.1085.81
linux-image-lowlatency 4.15.0.136.123
linux-image-oracle-lts-18.04 4.15.0.1065.75
linux-image-powerpc-e500mc 4.15.0.136.123
linux-image-powerpc-smp 4.15.0.136.123
linux-image-powerpc64-emb 4.15.0.136.123
linux-image-powerpc64-smp 4.15.0.136.123
linux-image-raspi2 4.15.0.1079.76
linux-image-snapdragon 4.15.0.1096.99
linux-image-virtual 4.15.0.136.123
Ubuntu 16.04 LTS:
linux-image-4.15.0-1065-oracle 4.15.0-1065.73~16.04.1
linux-image-4.15.0-1093-gcp 4.15.0-1093.106~16.04.1
linux-image-4.15.0-1094-aws 4.15.0-1094.101~16.04.1
linux-image-4.15.0-1108-azure 4.15.0-1108.120~16.04.1
linux-image-4.15.0-136-generic 4.15.0-136.140~16.04.1
linux-image-4.15.0-136-generic-lpae 4.15.0-136.140~16.04.1
linux-image-4.15.0-136-lowlatency 4.15.0-136.140~16.04.1
linux-image-aws-hwe 4.15.0.1094.87
linux-image-azure 4.15.0.1108.99
linux-image-gcp 4.15.0.1093.94
linux-image-generic-hwe-16.04 4.15.0.136.132
linux-image-generic-lpae-hwe-16.04 4.15.0.136.132
linux-image-gke 4.15.0.1093.94
linux-image-lowlatency-hwe-16.04 4.15.0.136.132
linux-image-oem 4.15.0.136.132
linux-image-oracle 4.15.0.1065.53
linux-image-virtual-hwe-16.04 4.15.0.136.132
Ubuntu 14.04 ESM:
linux-image-4.15.0-1108-azure 4.15.0-1108.120~14.04.1
linux-image-azure 4.15.0.1108.81
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/4749-1
CVE-2020-25669, CVE-2020-27815, CVE-2020-27830, CVE-2020-28941,
CVE-2020-29374, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660,
CVE-2020-29661
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-136.140
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1094.101
https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1108.120
https://launchpad.net/ubuntu/+source/linux-dell300x/4.15.0-1012.16
https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1093.106
https://launchpad.net/ubuntu/+source/linux-gke-4.15/4.15.0-1079.84
https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1085.87
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1065.73
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1079.84
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1096.105
https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1094.101~16.04.1
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1108.120~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1093.106~16.04.1
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-136.140~16.04.1
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1065.73~16.04.1
Subscribe to:
Posts (Atom)