USN-4526-1

Advisory lineage Upstream: 20 Downstream: 0
Published: 23 Sept 2020, 07:42
Last modified:03 Jun 2026, 13:33

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

23 Sept 2020, 07:42
Published
Vulnerability first disclosed
03 Jun 2026, 13:33
Last Modified
Vulnerability information updated

Description

linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities It was discovered that the AMD Cryptographic Coprocessor device driver in the Linux kernel did not properly deallocate memory in some situations. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-18808) It was discovered that the Conexant 23885 TV card device driver for the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-19054) It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-19061) It was discovered that the AMD Audio Coprocessor driver for the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker with the ability to load modules could use this to cause a denial of service (memory exhaustion). (CVE-2019-19067) It was discovered that the Atheros HTC based wireless driver in the Linux kernel did not properly deallocate in certain error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-19073, CVE-2019-19074) It was discovered that the F2FS file system in the Linux kernel did not properly perform bounds checking in some situations, leading to an out-of- bounds read. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-9445) It was discovered that the VFIO PCI driver in the Linux kernel did not properly handle attempts to access disabled memory spaces. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12888) It was discovered that the cgroup v2 subsystem in the Linux kernel did not properly perform reference counting in some situations, leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service or possibly gain administrative privileges. (CVE-2020-14356) It was discovered that the state of network RNG in the Linux kernel was potentially observable. A remote attacker could use this to expose sensitive information. (CVE-2020-16166)

Affected Systems

  • ubuntu•linux

    < 4.15.0-118.119

  • ubuntu•linux-aws

    < 4.15.0-1083.87

  • ubuntu•linux-aws-hwe

    < 4.15.0-1083.87~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1096.106~14.04.1 | < 4.15.0-1096.106~16.04.1

  • ubuntu•linux-azure-4.15

    < 4.15.0-1096.106

  • ubuntu•linux-gcp

    < 4.15.0-1084.95~16.04.1

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1084.95

  • ubuntu•linux-gke-4.15

    < 4.15.0-1070.73

  • ubuntu•linux-hwe

    < 4.15.0-118.119~16.04.1

  • ubuntu•linux-kvm

    < 4.15.0-1075.76

  • ubuntu•linux-oem

    < 4.15.0-1097.107

  • ubuntu•linux-oracle

    < 4.15.0-1054.58~16.04.1 | < 4.15.0-1054.58

  • ubuntu•linux-raspi2

    < 4.15.0-1071.75

  • ubuntu•linux-snapdragon

    < 4.15.0-1087.95

References (11)