what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Kernel Live Patch Security Notice LSN-0074-1

Kernel Live Patch Security Notice LSN-0074-1
Posted Feb 1, 2021
Authored by Benjamin M. Romer

Elena Petrova discovered that the pin controller device tree implementation in the Linux kernel did not properly handle string references. A local attacker could use this to expose sensitive information (kernel memory). Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). Various other issues were also addressed.

tags | advisory, remote, kernel, local
systems | linux
advisories | CVE-2020-0427, CVE-2020-12352, CVE-2020-25645, CVE-2020-28374
SHA-256 | 682e52dd49535c7ff7a41efaf9cdf2164f511e0432317c6e2e9cafb8c2198527

Kernel Live Patch Security Notice LSN-0074-1

Change Mirror Download
Linux kernel vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM

Summary

Several security issues were fixed in the kernel.

Software Description

- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-aws-fips - Linux FIPS kernel for Amazon Web Services (AWS)
systems
- linux-azure - Linux kernel for Microsoft Azure Cloud systems
- linux-azure-fips - Linux FIPS kernel for Microsoft Azure Cloud
systems
- linux-fips - Linux FIPS kernel
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke - Linux kernel for Google Container Engine (GKE) systems
- linux-gkeop - Linux kernel for Google Container Engine (GKE) On-
Prem systems
- linux-oem - Linux kernel for OEM systems

Details

Elena Petrova discovered that the pin controller device tree
implementation in the Linux kernel did not properly handle string
references. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2020-0427)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the
Linux kernel did not properly initialize memory in some situations. A
physically proximate remote attacker could use this to expose sensitive
information (kernel memory). (CVE-2020-12352)

It was discovered that the GENEVE tunnel implementation in the Linux
kernel when combined with IPSec did not properly select IP routes in
some situations. An attacker could use this to expose sensitive
information (unencrypted network traffic). (CVE-2020-25645)

It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)

Update instructions

The problem can be corrected by updating your kernel livepatch to the
following versions:

Ubuntu 18.04 LTS
aws - 74.1
aws-fips - 74.1
azure-fips - 74.1
fips - 74.1
generic - 74.1
gke - 74.1
gkeop - 74.1
lowlatency - 74.1
oem - 74.1

Ubuntu 20.04 LTS
aws - 74.1
azure - 74.1
gcp - 74.1
generic - 74.1
gke - 74.1
lowlatency - 74.1

Ubuntu 16.04 LTS
aws - 74.1
azure - 74.1
fips - 74.1
generic - 74.1
lowlatency - 74.1

Ubuntu 14.04 ESM
generic - 74.1
lowlatency - 74.1

Support Information

Kernels older than the levels listed below do not receive livepatch
updates. If you are running a kernel version earlier than the one
listed
below, please upgrade your kernel as soon as possible.

Ubuntu 18.04 LTS
linux-aws-fips - 4.15.0-2030
linux-aws - 4.15.0-1054
linux-azure-fips - 4.15.0-2012
linux-fips - 4.15.0-1045
linux-gke-4.15 - 4.15.0-1076
linux-gke-5.4 - 5.4.0-1009
linux-gkeop-5.4 - 5.4.0-1007
linux-hwe-5.4 - 5.4.0-26
linux-oem - 4.15.0-1063
linux - 4.15.0-69

Ubuntu 20.04 LTS
linux-aws - 5.4.0-1009
linux-azure - 5.4.0-1010
linux-gcp - 5.4.0-1009
linux-gke - 5.4.0-1033
linux-gkeop - 5.4.0-1009
linux-oem - 5.4.0-26
linux - 5.4.0-26

Ubuntu 16.04 LTS
linux-aws - 4.4.0-1098
linux-azure - 4.15.0-1063
linux-azure - 4.15.0-1078
linux-fips - 4.4.0-1049
linux-hwe - 4.15.0-69
linux - 4.4.0-168

Ubuntu 14.04 ESM
linux-lts-xenial - 4.4.0-168

References

- CVE-2020-0427
- CVE-2020-12352
- CVE-2020-25645
- CVE-2020-28374



--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close