USN-4324-1

Description

linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Al Viro discovered that the vfs layer in the Linux kernel contained a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-8428) Shijie Luo discovered that the ext4 file system implementation in the Linux kernel did not properly check for a too-large journal size. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (soft lockup). (CVE-2020-8992)

Affected Systems

• ubuntu•linux-aws

  < 4.15.0-1065.69

• ubuntu•linux-aws-hwe

  < 4.15.0-1065.69~16.04.1

• ubuntu•linux-azure

  < 4.15.0-1077.82~14.04.1 | < 4.15.0-1077.82

• ubuntu•linux-gcp

  < 4.15.0-1060.64

• ubuntu•linux-gke-4.15

  < 4.15.0-1057.60

• ubuntu•linux-kvm

  < 4.15.0-1058.59

• ubuntu•linux-oem

  < 4.15.0-1079.89

• ubuntu•linux-oracle

  < 4.15.0-1037.41~16.04.1 | < 4.15.0-1037.41

• ubuntu•linux-raspi2

  < 4.15.0-1060.64

• ubuntu•linux-snapdragon

  < 4.15.0-1076.83

References (3)

• https://ubuntu.com/security/notices/USN-4324-1
• https://ubuntu.com/security/CVE-2020-8428
• https://ubuntu.com/security/CVE-2020-8992