USN-5016-1

Description

linux, linux-aws, linux-aws-5.8, linux-azure, linux-azure-5.8, linux-gcp, linux-gcp-5.8, linux-hwe-5.8, linux-kvm, linux-oracle, linux-oracle-5.8, linux-raspi vulnerabilities It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-33909) Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the nfc implementation in the Linux kernel. A privileged local attacker could use this issue to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-23134) It was discovered that a race condition in the kernel Bluetooth subsystem could lead to use-after-free of slab objects. An attacker could use this issue to possibly execute arbitrary code. (CVE-2021-32399) It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33034) It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506)

Affected Systems

• ubuntu•linux-aws-5.8

  < 5.8.0-1041.43~20.04.1

• ubuntu•linux-azure-5.8

  < 5.8.0-1039.42~20.04.1

• ubuntu•linux-gcp-5.8

  < 5.8.0-1038.40~20.04.1

• ubuntu•linux-hwe-5.8

  < 5.8.0-63.71~20.04.1

• ubuntu•linux-oracle-5.8

  < 5.8.0-1037.38~20.04.1

References (6)

• https://ubuntu.com/security/notices/USN-5016-1
• https://ubuntu.com/security/CVE-2021-3506
• https://ubuntu.com/security/CVE-2021-23134
• https://ubuntu.com/security/CVE-2021-32399
• https://ubuntu.com/security/CVE-2021-33034
• https://ubuntu.com/security/CVE-2021-33909