Summary
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Giuseppe Scrivano discovered that the overlay file system in the Linux
kernel did not properly perform permission checks in some situations. A
local attacker could possibly use this to bypass intended restrictions and
gain read access to restricted files. (CVE-2020-16120)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gke-5.0 | 5.0.0-1049.50 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gke-5.3 | 5.3.0-1038.40 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-hwe | 5.3.0-68.63 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oem-osp1 | 5.0.0-1069.75 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2-5.3 | 5.3.0-1035.37 |
Vulnerabilities 2
-
Medium 6.3
DCCP CCID structure use-after-free
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, …
-
Medium 5.1
Unprivileged overlay + shiftfs read access
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unp…