Summary
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly perform access control. An authenticated attacker could possibly
use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)
Michael Brown discovered that the Xen netback driver in the Linux kernel
did not properly handle malformed packets from a network PV frontend,
leading to a use-after-free vulnerability. An attacker in a guest VM could
use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2021-28691)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2021-3564)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device detach events, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2021-3573)
It was discovered that the NFC implementation in the Linux kernel did not
properly handle failed connect events leading to a NULL pointer
dereference. A local attacker could use this to cause a denial of service.
(CVE-2021-38208)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws-5.8 | 5.8.0-1042.44~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-azure-5.8 | 5.8.0-1040.43~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp-5.8 | 5.8.0-1039.41 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oracle-5.8 | 5.8.0-1038.39~20.04.1 |
Vulnerabilities 6
-
Unscored —
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-m…
-
Unscored —
Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjac…
-
Unscored —
Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to…
-
Unscored —
A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user …
-
Unscored —
A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls i…
-
Unscored —
net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NU…