USN-4578-1

Advisory lineage Upstream: 14 Downstream: 0
Published: 14 Oct 2020, 02:06
Last modified:23 May 2026, 01:31

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Oct 2020, 02:06
Published
Vulnerability first disclosed
23 May 2026, 01:31
Last Modified
Vulnerability information updated

Description

linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-16119) Wen Xu discovered that the XFS file system in the Linux kernel did not properly validate inode metadata in some situations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10322) It was discovered that the btrfs file system in the Linux kernel contained a use-after-free vulnerability when merging free space. An attacker could use this to construct a malicious btrfs image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2019-19448) Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-14314) Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform permission checks in some situations. A local attacker could possibly use this to bypass intended restrictions and gain read access to restricted files. (CVE-2020-16120) It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds checking before copying security labels in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212) It was discovered that the NFC implementation in the Linux kernel did not properly perform permissions checks when opening raw sockets. A local attacker could use this to create or listen to NFC traffic. (CVE-2020-26088)

Affected Systems

  • ubuntu•linux

    < 4.15.0-121.123

  • ubuntu•linux-aws

    < 4.15.0-1086.91

  • ubuntu•linux-aws-hwe

    < 4.15.0-1085.90~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1098.109~14.04.1 | < 4.15.0-1098.109~16.04.1

  • ubuntu•linux-azure-4.15

    < 4.15.0-1099.110

  • ubuntu•linux-gcp

    < 4.15.0-1086.98~16.04.1

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1086.98

  • ubuntu•linux-gke-4.15

    < 4.15.0-1072.76

  • ubuntu•linux-hwe

    < 4.15.0-120.122~16.04.1

  • ubuntu•linux-kvm

    < 4.15.0-1077.79

  • ubuntu•linux-oem

    < 4.15.0-1099.109

  • ubuntu•linux-oracle

    < 4.15.0-1056.61~16.04.1 | < 4.15.0-1057.62

  • ubuntu•linux-raspi2

    < 4.15.0-1073.78

  • ubuntu•linux-snapdragon

    < 4.15.0-1089.98

References (8)