Ubuntu Security Notice 4916-1 - It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate computation of branch displacements in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
731316af4af43b6a4f4a4888d410c88049b391c7650608ca1fd2ed0566f0f141
==========================================================================
Ubuntu Security Notice USN-4916-1
April 15, 2021
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15,
linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm,
linux-lts-xenial, linux-oracle, linux-raspi2, linux-snapdragon
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems
- linux-dell300x: Linux kernel for Dell 300x platforms
- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi2: Linux kernel for Raspberry Pi (V8) systems
- linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors
- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
It was discovered that the overlayfs implementation in the Linux kernel did
not properly validate the application of file system capabilities with
respect to user namespaces. A local attacker could use this to gain
elevated privileges. (CVE-2021-3493)
Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux
kernel did not properly validate computation of branch displacements in
some situations. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1017-dell300x 4.15.0-1017.21
linux-image-4.15.0-1070-oracle 4.15.0-1070.78
linux-image-4.15.0-1084-raspi2 4.15.0-1084.89
linux-image-4.15.0-1090-kvm 4.15.0-1090.92
linux-image-4.15.0-1098-gcp 4.15.0-1098.111
linux-image-4.15.0-1099-aws 4.15.0-1099.106
linux-image-4.15.0-1101-snapdragon 4.15.0-1101.110
linux-image-4.15.0-1113-azure 4.15.0-1113.126
linux-image-4.15.0-142-generic 4.15.0-142.146
linux-image-4.15.0-142-generic-lpae 4.15.0-142.146
linux-image-4.15.0-142-lowlatency 4.15.0-142.146
linux-image-aws-lts-18.04 4.15.0.1099.102
linux-image-azure-lts-18.04 4.15.0.1113.86
linux-image-dell300x 4.15.0.1017.19
linux-image-gcp-lts-18.04 4.15.0.1098.116
linux-image-generic 4.15.0.142.129
linux-image-generic-lpae 4.15.0.142.129
linux-image-kvm 4.15.0.1090.86
linux-image-lowlatency 4.15.0.142.129
linux-image-oracle-lts-18.04 4.15.0.1070.80
linux-image-powerpc-e500mc 4.15.0.142.129
linux-image-powerpc-smp 4.15.0.142.129
linux-image-powerpc64-emb 4.15.0.142.129
linux-image-powerpc64-smp 4.15.0.142.129
linux-image-raspi2 4.15.0.1084.81
linux-image-snapdragon 4.15.0.1101.104
linux-image-virtual 4.15.0.142.129
Ubuntu 16.04 LTS:
linux-image-4.15.0-1070-oracle 4.15.0-1070.78~16.04.1
linux-image-4.15.0-1098-gcp 4.15.0-1098.111~16.04.1
linux-image-4.15.0-1099-aws 4.15.0-1099.106~16.04.1
linux-image-4.15.0-1113-azure 4.15.0-1113.126~16.04.1
linux-image-4.15.0-142-generic 4.15.0-142.146~16.04.1
linux-image-4.15.0-142-generic-lpae 4.15.0-142.146~16.04.1
linux-image-4.15.0-142-lowlatency 4.15.0-142.146~16.04.1
linux-image-4.4.0-1092-kvm 4.4.0-1092.101
linux-image-4.4.0-1127-aws 4.4.0-1127.141
linux-image-4.4.0-1151-raspi2 4.4.0-1151.162
linux-image-4.4.0-1155-snapdragon 4.4.0-1155.165
linux-image-4.4.0-209-generic 4.4.0-209.241
linux-image-4.4.0-209-generic-lpae 4.4.0-209.241
linux-image-4.4.0-209-lowlatency 4.4.0-209.241
linux-image-4.4.0-209-powerpc-e500mc 4.4.0-209.241
linux-image-4.4.0-209-powerpc-smp 4.4.0-209.241
linux-image-4.4.0-209-powerpc64-emb 4.4.0-209.241
linux-image-4.4.0-209-powerpc64-smp 4.4.0-209.241
linux-image-aws 4.4.0.1127.132
linux-image-aws-hwe 4.15.0.1099.92
linux-image-azure 4.15.0.1113.104
linux-image-gcp 4.15.0.1098.99
linux-image-generic 4.4.0.209.215
linux-image-generic-hwe-16.04 4.15.0.142.137
linux-image-generic-lpae 4.4.0.209.215
linux-image-generic-lpae-hwe-16.04 4.15.0.142.137
linux-image-gke 4.15.0.1098.99
linux-image-kvm 4.4.0.1092.90
linux-image-lowlatency 4.4.0.209.215
linux-image-lowlatency-hwe-16.04 4.15.0.142.137
linux-image-oem 4.15.0.142.137
linux-image-oracle 4.15.0.1070.58
linux-image-powerpc-e500mc 4.4.0.209.215
linux-image-powerpc-smp 4.4.0.209.215
linux-image-powerpc64-emb 4.4.0.209.215
linux-image-powerpc64-smp 4.4.0.209.215
linux-image-raspi2 4.4.0.1151.151
linux-image-snapdragon 4.4.0.1155.147
linux-image-virtual 4.4.0.209.215
linux-image-virtual-hwe-16.04 4.15.0.142.137
Ubuntu 14.04 ESM:
linux-image-4.15.0-1113-azure 4.15.0-1113.126~14.04.1
linux-image-4.4.0-1091-aws 4.4.0-1091.95
linux-image-4.4.0-209-generic 4.4.0-209.241~14.04.1
linux-image-4.4.0-209-generic-lpae 4.4.0-209.241~14.04.1
linux-image-4.4.0-209-lowlatency 4.4.0-209.241~14.04.1
linux-image-4.4.0-209-powerpc-e500mc 4.4.0-209.241~14.04.1
linux-image-4.4.0-209-powerpc-smp 4.4.0-209.241~14.04.1
linux-image-4.4.0-209-powerpc64-emb 4.4.0-209.241~14.04.1
linux-image-4.4.0-209-powerpc64-smp 4.4.0-209.241~14.04.1
linux-image-aws 4.4.0.1091.88
linux-image-azure 4.15.0.1113.86
linux-image-generic-lpae-lts-xenial 4.4.0.209.182
linux-image-generic-lts-xenial 4.4.0.209.182
linux-image-lowlatency-lts-xenial 4.4.0.209.182
linux-image-powerpc-e500mc-lts-xenial 4.4.0.209.182
linux-image-powerpc-smp-lts-xenial 4.4.0.209.182
linux-image-powerpc64-emb-lts-xenial 4.4.0.209.182
linux-image-powerpc64-smp-lts-xenial 4.4.0.209.182
linux-image-virtual-lts-xenial 4.4.0.209.182
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-4916-1
CVE-2021-29154, CVE-2021-3493
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-142.146
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1099.106
https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1113.126
https://launchpad.net/ubuntu/+source/linux-dell300x/4.15.0-1017.21
https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1098.111
https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1090.92
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1070.78
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1084.89
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1101.110
https://launchpad.net/ubuntu/+source/linux/4.4.0-209.241
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1127.141
https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1099.106~16.04.1
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1113.126~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1098.111~16.04.1
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-142.146~16.04.1
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1092.101
https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1070.78~16.04.1
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1151.162
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1155.165