Summary
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux
kernel did not properly handle faults in copy_from_user() when passing
through ioctls to an underlying file system. A local attacker could use
this to cause a denial of service (memory exhaustion) or execute arbitrary
code. (CVE-2021-3492)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws-5.4 | 5.4.0-1045.47~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-azure-5.4 | 5.4.0-1046.48~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gcp-5.4 | 5.4.0-1042.45~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gke-5.3 | 5.3.0-1042.45 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gke-5.4 | 5.4.0-1042.44~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gkeop-5.4 | 5.4.0-1014.15~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-hwe | 5.3.0-73.69 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-hwe-5.4 | 5.4.0-72.80~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle-5.4 | 5.4.0-1043.46~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi-5.4 | 5.4.0-1034.37~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2-5.3 | 5.3.0-1039.41 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux | 5.4.0-72.80 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws | 5.4.0-1045.47 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-azure | 5.4.0-1046.48 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp | 5.4.0-1042.45 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gkeop | 5.4.0-1014.15 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-hwe-5.8 | 5.8.0-50.56~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-kvm | 5.4.0-1038.39 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oem-5.10 | 5.10.0-1022.23 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oracle | 5.4.0-1043.46 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-raspi | 5.4.0-1034.37 |
Vulnerabilities 3
-
High 8.8
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …
KEV Oct 20, 2022 -
High 8.8CVE-2021-3492 Public exploit
Ubuntu linux kernel shiftfs file system double free vulnerability
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could u…
-
Unscored —
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…