USN-4749-1: Linux kernel vulnerabilities
24004
16 April 2021
16 April 2021
CLOSED
MEDIUM
CVE-2020-25669,CVE-2020-27815,CVE-2020-27830,CVE-2020-28941,CVE-2020-29374,CVE-2020-29568,CVE-2020-29569,CVE-2020-29660,CVE-2020-29661
Severity
Medium
Vendor
VMware Tanzu
Versions Affected
- Canonical Ubuntu 16.04
Description
Bodong Zhao discovered a use-after-free in the Sun keyboard driver implementation in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash). (CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in the Linux kernel did not correctly handle setting line discipline in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-27830, CVE-2020-28941)
It was discovered that the memory management subsystem in the Linux kernel did not properly handle copy-on-write operations in some situations. A local attacker could possibly use this to gain unintended write access to read-only memory pages. (CVE-2020-29374)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event processing backend in the Linux kernel did not properly limit the number of events queued. An attacker in a guest VM could use this to cause a denial of service in the host OS. (CVE-2020-29568)
Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the Xen paravirt block backend in the Linux kernel, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service in the host OS. (CVE-2020-29569)
Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660)
Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
CVEs contained in this USN include: CVE-2020-25669, CVE-2020-27815, CVE-2020-29660, CVE-2020-27830, CVE-2020-29568, CVE-2020-29374, CVE-2020-29569, CVE-2020-29661, CVE-2020-28941
Affected VMware Products and Versions
Severity is medium unless otherwise noted.
Impacted stemcells may be updated independently of upgrading Tanzu Application Service or Isolation Segment.
- Isolation Segment
- 2.7.x versions with Xenial Stemcells prior to 456.145
- 2.8.x versions with Xenial Stemcells prior to 621.108
- 2.9.x versions with Xenial Stemcells prior to 621.108
- 2.10.x versions with Xenial Stemcells prior to 621.108
- Operations Manager
- 2.7.x versions prior to 2.7.30
- 2.8.x versions prior to 2.8.16
- 2.9.x versions prior to 2.9.18
- 2.10.x versions prior to 2.10.9
- VMware Tanzu Application Service for VMs
- 2.7.x versions with Xenial Stemcells prior to 456.145
- 2.8.x versions with Xenial Stemcells prior to 621.108
- 2.9.x versions with Xenial Stemcells prior to 621.108
- 2.10.x versions with Xenial Stemcells prior to 621.108
- 2.11.x versions with Xenial Stemcells prior to 621.108
Mitigation
Users of affected products are strongly encouraged to follow the mitigation below. It is recommended to upgrade the affected Cloud Foundry components listed here if applicable. Upgrade VMware Tanzu products that use earlier versions of CF components to new Tanzu releases using new versions linked above. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:- Isolation Segment
- 2.7.x: Upgrade Xenial Stemcells to 456.145 or greater
- 2.8.x: Upgrade Xenial Stemcells to 621.108 or greater
- 2.9.x: Upgrade Xenial Stemcells to 621.108 or greater
- 2.10.x: Upgrade Xenial Stemcells to 621.108 or greater
- Operations Manager
- 2.7.30
- 2.8.16
- 2.9.18
- 2.10.9
- VMware Tanzu Application Service for VMs
- 2.7.x: Upgrade Xenial Stemcells to 456.145 or greater
- 2.8.x: Upgrade Xenial Stemcells to 621.108 or greater
- 2.9.x: Upgrade Xenial Stemcells to 621.108 or greater
- 2.10.x: Upgrade Xenial Stemcells to 621.108 or greater
- 2.11.x: Upgrade Xenial Stemcells to 621.108 or greater
References
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-25669
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-27815
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-29660
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-27830
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-29568
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-29374
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-29569
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-29661
- https://people.canonical.com/~ubuntu-security/cve/CVE-2020-28941
- https://ubuntu.com/security/notices/USN-4749-1
- https://cloudfoundry.org/blog/usn-4749-1
History
2021-04-16: Initial vulnerability report published.