Summary
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
David Alan Gilbert discovered that the XFS file system implementation in
the Linux kernel did not properly perform metadata validation in some
circumstances. A local attacker could use this to cause a denial of
service. (CVE-2020-14385)
Giuseppe Scrivano discovered that the overlay file system in the Linux
kernel did not properly perform permission checks in some situations. A
local attacker could possibly use this to bypass intended restrictions and
gain read access to restricted files. (CVE-2020-16120)
It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)
It was discovered that the block layer subsystem in the Linux kernel did
not properly handle zero-length requests. A local attacker could use this
to cause a denial of service. (CVE-2020-25641)
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws-5.4 | 5.4.0-1028.29~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-azure-5.4 | 5.4.0-1031.32~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gcp-5.4 | 5.4.0-1028.29~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-hwe-5.4 | 5.4.0-51.56~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle-5.4 | 5.4.0-1028.29~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi-5.4 | 5.4.0-1021.24~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux | 5.4.0-51.56 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws | 5.4.0-1028.29 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-azure | 5.4.0-1031.32 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp | 5.4.0-1028.29 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-kvm | 5.4.0-1026.27 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oracle | 5.4.0-1028.29 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-raspi | 5.4.0-1021.24 |
Vulnerabilities 6
-
Medium 6.3
DCCP CCID structure use-after-free
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, …
-
Medium 5.5
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the wa…
-
Medium 5.5
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause a…
-
Medium 5.1
Unprivileged overlay + shiftfs read access
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unp…
-
Unscored —
A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by loca…
-
Unscored —
A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec reque…