Summary
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)
Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did
not properly deallocate memory in some situations. A privileged attacker
could use this to cause a denial of service (kernel memory exhaustion).
(CVE-2020-25704)
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux-aws-hwe | 4.15.0-1093.99~16.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-azure | 4.15.0-1106.118~16.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-gcp | 4.15.0-1092.105~16.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-oracle | 4.15.0-1064.71~16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws | 4.15.0-1093.99 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-azure-4.15 | 4.15.0-1106.118 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gcp-4.15 | 4.15.0-1092.105 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gke-4.15 | 4.15.0-1078.83 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-kvm | 4.15.0-1084.86 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle | 4.15.0-1064.71 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2 | 4.15.0-1078.83 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-snapdragon | 4.15.0-1095.104 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1106.118~14.04.1 |
Vulnerabilities 2
-
Unscored —
A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SE…
-
Unscored —
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SC…