Summary
Al Viro discovered that the vfs layer in the Linux kernel contained a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly expose sensitive information (kernel
memory). (CVE-2020-8428)
Shijie Luo discovered that the ext4 file system implementation in the Linux
kernel did not properly check for a too-large journal size. An attacker
could use this to construct a malicious ext4 image that, when mounted,
could cause a denial of service (soft lockup). (CVE-2020-8992)
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux-aws-hwe | 4.15.0-1065.69~16.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-azure | 4.15.0-1077.82 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-gcp | 4.15.0-1060.64 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-oracle | 4.15.0-1037.41~16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws | 4.15.0-1065.69 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gke-4.15 | 4.15.0-1057.60 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-kvm | 4.15.0-1058.59 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oem | 4.15.0-1079.89 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle | 4.15.0-1037.41 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2 | 4.15.0-1060.64 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-snapdragon | 4.15.0-1076.83 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1077.82~14.04.1 |
Vulnerabilities 2
-
Unscored —
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause …
-
Unscored —
ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a d…