Summary
Al Viro discovered that the vfs layer in the Linux kernel contained a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly expose sensitive information (kernel
memory). (CVE-2020-8428)
Gustavo Romero and Paul Mackerras discovered that the KVM implementation in
the Linux kernel for PowerPC processors did not properly keep guest state
separate from host state. A local attacker in a KVM guest could use this to
cause a denial of service (host system crash). (CVE-2020-8834)
Shijie Luo discovered that the ext4 file system implementation in the Linux
kernel did not properly check for a too-large journal size. An attacker
could use this to construct a malicious ext4 image that, when mounted,
could cause a denial of service (soft lockup). (CVE-2020-8992)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux-hwe | 4.15.0-96.97~16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux | 4.15.0-96.97 |
Vulnerabilities 3
-
Medium 6.5
Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space o…
-
Unscored —
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause …
-
Unscored —
ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a d…