USN-5003-1: Linux kernel vulnerabilities
24065
08 December 2021
08 December 2021
CLOSED
HIGH
CVE-2021-23133,CVE-2021-3600,CVE-2021-3609
Severity
high
Vendor
VMware Tanzu
Versions Affected
- Canonical Ubuntu 16.04
Description
Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute arbitrary code. (CVE-2021-3609)
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code. (CVE-2021-3600)
Or Cohen discovered that the SCTP implementation in the Linux kernel contained a race condition in some situations, leading to a use-after-free condition. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-23133)
CVEs contained in this USN include: CVE-2021-3609, CVE-2021-23133, CVE-2021-3600
Affected VMware Products and Versions
Severity is high unless otherwise noted.
- Isolation Segment
- 2.7.x versions with Xenial Stemcells prior to 456.166
- 2.8.x versions with Xenial Stemcells prior to 621.131
- 2.9.x versions with Xenial Stemcells prior to 621.131
- 2.10.x versions with Xenial Stemcells prior to 621.131
- 2.11.x versions with Xenial Stemcells prior to 621.131
- Operations Manager
- 2.9.x versions prior to 2.9.21
- 2.10.x versions prior to 2.10.15
- VMware Tanzu Application Service for VMs
- 2.7.x versions with Xenial Stemcells prior to 456.166
- 2.8.x versions with Xenial Stemcells prior to 621.131
- 2.9.x versions with Xenial Stemcells prior to 621.131
- 2.10.x versions with Xenial Stemcells prior to 621.131
- 2.11.x versions with Xenial Stemcells prior to 621.131
- 2.12.x versions with Xenial Stemcells prior to 621.131
Mitigation
Users of affected products are strongly encouraged to follow the mitigation below. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:- Isolation Segment
- 2.7.x: Upgrade Xenial Stemcells to 456.166 or greater
- 2.8.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.9.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.10.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.11.x: Upgrade Xenial Stemcells to 621.131 or greater
- Operations Manager
- 2.9.21
- 2.10.15
- VMware Tanzu Application Service for VMs
- 2.7.x: Upgrade Xenial Stemcells to 456.166 or greater
- 2.8.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.9.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.10.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.11.x: Upgrade Xenial Stemcells to 621.131 or greater
- 2.12.x: Upgrade Xenial Stemcells to 621.131 or greater
References
- https://people.canonical.com/~ubuntu-security/cve/CVE-2021-3609
- https://people.canonical.com/~ubuntu-security/cve/CVE-2021-23133
- https://people.canonical.com/~ubuntu-security/cve/CVE-2021-3600
- https://ubuntu.com/security/notices/USN-5003-1
History
2021-12-08: Initial vulnerability report published.