USN-5268-1: Linux kernel vulnerabilities

23970

17 March 2022

17 March 2022

CLOSED

MEDIUM

CVE-2021-20322,CVE-2021-3640,CVE-2021-3752,CVE-2021-42739

Severity

medium

Vendor

VMware Tanzu

Versions Affected

  • Canonical Ubuntu 16.04
  • Canonical Ubuntu 18.04

Description

Keyu Man discovered that the ICMP implementation in the Linux kernel did not properly handle received ICMP error packets. A remote attacker could use this to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2021-20322) It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640) Likang Luo discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3752) Luo Likang discovered that the FireDTV Firewire driver in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42739)

CVEs contained in this USN include: CVE-2021-42739, CVE-2021-20322, CVE-2021-3640, CVE-2021-3752

Affected VMware Products and Versions

Severity is medium unless otherwise noted.

  • Platform Automation Toolkit
    • 4.0.x versions prior to 4.0.13
    • 4.1.x versions prior to 4.1.13
    • 4.2.x versions prior to 4.2.8
    • 4.3.x versions prior to 4.3.5
  • Isolation Segment
    • 2.7.x versions prior to 2.7.42, or later versions with Xenial Stemcells prior to 456.236
    • 2.10.x versions prior to 2.10.22, or later versions with Xenial Stemcells prior to 621.208
    • 2.11.x versions prior to 2.11.11, or later versions with Xenial Stemcells prior to 621.208
    • 2.12.x versions prior to 2.12.5, or later versions with Xenial Stemcells prior to 621.208
  • Operations Manager
    • 2.9.x versions prior to 2.9.30
    • 2.10.x versions prior to 2.10.29
  • VMware Tanzu Application Service for VMs
    • 2.7.x versions prior to 2.7.47, or later versions with Xenial Stemcells prior to 456.236
    • 2.10.x versions prior to 2.10.27, or later versions with Xenial Stemcells prior to 621.208
    • 2.11.x versions prior to 2.11.15, or later versions with Xenial Stemcells prior to 621.208
    • 2.12.x versions prior to 2.12.8, or later versions with Xenial Stemcells prior to 621.208

Mitigation

Users of affected products are strongly encouraged to follow the mitigation below. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:
  • Platform Automation Toolkit
    • 4.0.13
    • 4.1.13
    • 4.2.8
    • 4.3.5
  • Isolation Segment
    • 2.7.42, and upgrade Xenial Stemcells to 456.236 or greater
    • 2.10.22, and upgrade Xenial Stemcells to 621.208 or greater
    • 2.11.11, and upgrade Xenial Stemcells to 621.208 or greater
    • 2.12.5, and upgrade Xenial Stemcells to 621.208 or greater
  • Operations Manager
    • 2.9.30
    • 2.10.29
  • VMware Tanzu Application Service for VMs
    • 2.7.47, and upgrade Xenial Stemcells to 456.236 or greater
    • 2.10.27, and upgrade Xenial Stemcells to 621.208 or greater
    • 2.11.15, and upgrade Xenial Stemcells to 621.208 or greater
    • 2.12.8, and upgrade Xenial Stemcells to 621.208 or greater

References

History

2022-03-17: Initial vulnerability report published.