USN-4749-1: Linux kernel vulnerabilities
First published: Thu Feb 25 2021(Updated: )
Bodong Zhao discovered a use-after-free in the Sun keyboard driver implementation in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2020-25669) It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash). (CVE-2020-27815) Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in the Linux kernel did not correctly handle setting line discipline in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-27830, CVE-2020-28941) It was discovered that the memory management subsystem in the Linux kernel did not properly handle copy-on-write operations in some situations. A local attacker could possibly use this to gain unintended write access to read-only memory pages. (CVE-2020-29374) Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event processing backend in the Linux kernel did not properly limit the number of events queued. An attacker in a guest VM could use this to cause a denial of service in the host OS. (CVE-2020-29568) Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the Xen paravirt block backend in the Linux kernel, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service in the host OS. (CVE-2020-29569) Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660) Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/linux-image-4.15.0-1012-dell300x | <4.15.0-1012.16 | 4.15.0-1012.16 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1065-oracle | <4.15.0-1065.73 | 4.15.0-1065.73 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1079-gke | <4.15.0-1079.84 | 4.15.0-1079.84 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1079-raspi2 | <4.15.0-1079.84 | 4.15.0-1079.84 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1085-kvm | <4.15.0-1085.87 | 4.15.0-1085.87 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1093-gcp | <4.15.0-1093.106 | 4.15.0-1093.106 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1094-aws | <4.15.0-1094.101 | 4.15.0-1094.101 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1096-snapdragon | <4.15.0-1096.105 | 4.15.0-1096.105 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1108-azure | <4.15.0-1108.120 | 4.15.0-1108.120 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-136-generic | <4.15.0-136.140 | 4.15.0-136.140 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-136-generic-lpae | <4.15.0-136.140 | 4.15.0-136.140 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-136-lowlatency | <4.15.0-136.140 | 4.15.0-136.140 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-aws-lts-18.04 | <4.15.0.1094.97 | 4.15.0.1094.97 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-azure-lts-18.04 | <4.15.0.1108.81 | 4.15.0.1108.81 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-dell300x | <4.15.0.1012.14 | 4.15.0.1012.14 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-gcp-lts-18.04 | <4.15.0.1093.111 | 4.15.0.1093.111 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-generic | <4.15.0.136.123 | 4.15.0.136.123 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-generic-lpae | <4.15.0.136.123 | 4.15.0.136.123 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-gke | <4.15.0.1079.83 | 4.15.0.1079.83 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-gke-4.15 | <4.15.0.1079.83 | 4.15.0.1079.83 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-kvm | <4.15.0.1085.81 | 4.15.0.1085.81 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-lowlatency | <4.15.0.136.123 | 4.15.0.136.123 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-oracle-lts-18.04 | <4.15.0.1065.75 | 4.15.0.1065.75 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-raspi2 | <4.15.0.1079.76 | 4.15.0.1079.76 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-snapdragon | <4.15.0.1096.99 | 4.15.0.1096.99 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-virtual | <4.15.0.136.123 | 4.15.0.136.123 |
| =18.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1065-oracle | <4.15.0-1065.73~16.04.1 | 4.15.0-1065.73~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1093-gcp | <4.15.0-1093.106~16.04.1 | 4.15.0-1093.106~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1094-aws | <4.15.0-1094.101~16.04.1 | 4.15.0-1094.101~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1108-azure | <4.15.0-1108.120~16.04.1 | 4.15.0-1108.120~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-136-generic | <4.15.0-136.140~16.04.1 | 4.15.0-136.140~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-136-generic-lpae | <4.15.0-136.140~16.04.1 | 4.15.0-136.140~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-136-lowlatency | <4.15.0-136.140~16.04.1 | 4.15.0-136.140~16.04.1 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-aws-hwe | <4.15.0.1094.87 | 4.15.0.1094.87 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-azure | <4.15.0.1108.99 | 4.15.0.1108.99 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-gcp | <4.15.0.1093.94 | 4.15.0.1093.94 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-generic-hwe-16.04 | <4.15.0.136.132 | 4.15.0.136.132 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-generic-lpae-hwe-16.04 | <4.15.0.136.132 | 4.15.0.136.132 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-gke | <4.15.0.1093.94 | 4.15.0.1093.94 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-lowlatency-hwe-16.04 | <4.15.0.136.132 | 4.15.0.136.132 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-oem | <4.15.0.136.132 | 4.15.0.136.132 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-oracle | <4.15.0.1065.53 | 4.15.0.1065.53 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-virtual-hwe-16.04 | <4.15.0.136.132 | 4.15.0.136.132 |
| =16.04 | ||
| All of | ||
| ubuntu/linux-image-4.15.0-1108-azure | <4.15.0-1108.120~14.04.1 | 4.15.0-1108.120~14.04.1 |
| =14.04 | ||
| All of | ||
| ubuntu/linux-image-azure | <4.15.0.1108.81 | 4.15.0.1108.81 |
| =14.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2020-27815
- https://ubuntu.com/security/CVE-2020-29660
- https://ubuntu.com/security/CVE-2020-27830
- https://ubuntu.com/security/CVE-2020-29568
- https://ubuntu.com/security/CVE-2020-29374
- https://ubuntu.com/security/CVE-2020-29569
- https://ubuntu.com/security/CVE-2020-29661
- https://ubuntu.com/security/CVE-2020-25669
- https://ubuntu.com/security/CVE-2020-28941
- https://ubuntu.com/security/notices/USN-4748-1
- https://ubuntu.com/security/notices/USN-4750-1
- https://ubuntu.com/security/notices/USN-4751-1
- https://ubuntu.com/security/notices/USN-4752-1
- https://ubuntu.com/security/notices/USN-5130-1
- https://ubuntu.com/security/notices/LSN-0082-1
- https://ubuntu.com/security/notices/USN-4912-1
- https://ubuntu.com/security/notices/USN-4876-1
- https://ubuntu.com/security/notices/USN-4708-1
- https://ubuntu.com/security/notices/USN-4709-1
- https://launchpad.net/ubuntu/+source/linux-signed-dell300x/4.15.0-1012.16
- https://launchpad.net/ubuntu/+source/linux-signed-oracle/4.15.0-1065.73
- https://launchpad.net/ubuntu/+source/linux-signed-gke-4.15/4.15.0-1079.84
- https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1079.84
- https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1085.87
- https://launchpad.net/ubuntu/+source/linux-signed-gcp-4.15/4.15.0-1093.106
- https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1094.101
- https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1096.105
- https://launchpad.net/ubuntu/+source/linux-signed-azure-4.15/4.15.0-1108.120
- https://launchpad.net/ubuntu/+source/linux-signed/4.15.0-136.140
- https://launchpad.net/ubuntu/+source/linux/4.15.0-136.140
- https://launchpad.net/ubuntu/+source/linux-meta-aws/4.15.0.1094.97
- https://launchpad.net/ubuntu/+source/linux-meta-azure-4.15/4.15.0.1108.81
- https://launchpad.net/ubuntu/+source/linux-meta-dell300x/4.15.0.1012.14
- https://launchpad.net/ubuntu/+source/linux-meta-gcp-4.15/4.15.0.1093.111
- https://launchpad.net/ubuntu/+source/linux-meta/4.15.0.136.123
- https://launchpad.net/ubuntu/+source/linux-meta-gke-4.15/4.15.0.1079.83
- https://launchpad.net/ubuntu/+source/linux-meta-kvm/4.15.0.1085.81
- https://launchpad.net/ubuntu/+source/linux-meta-oracle/4.15.0.1065.75
- https://launchpad.net/ubuntu/+source/linux-meta-raspi2/4.15.0.1079.76
- https://launchpad.net/ubuntu/+source/linux-meta-snapdragon/4.15.0.1096.99
- https://launchpad.net/ubuntu/+source/linux-signed-oracle/4.15.0-1065.73~16.04.1
- https://launchpad.net/ubuntu/+source/linux-signed-gcp/4.15.0-1093.106~16.04.1
- https://launchpad.net/ubuntu/+source/linux-aws-hwe/4.15.0-1094.101~16.04.1
- https://launchpad.net/ubuntu/+source/linux-signed-azure/4.15.0-1108.120~16.04.1
- https://launchpad.net/ubuntu/+source/linux-signed-hwe/4.15.0-136.140~16.04.1
- https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-136.140~16.04.1
- https://launchpad.net/ubuntu/+source/linux-meta-aws-hwe/4.15.0.1094.87
- https://launchpad.net/ubuntu/+source/linux-meta-azure/4.15.0.1108.99
- https://launchpad.net/ubuntu/+source/linux-meta-gcp/4.15.0.1093.94
- https://launchpad.net/ubuntu/+source/linux-meta-hwe/4.15.0.136.132
- https://launchpad.net/ubuntu/+source/linux-meta-oracle/4.15.0.1065.53
- https://launchpad.net/ubuntu/+source/linux-signed-azure/4.15.0-1108.120~14.04.1
- https://launchpad.net/ubuntu/+source/linux-meta-azure/4.15.0.1108.81
- https://ubuntu.com/security/notices/USN-4749-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/title
- agent/description
- agent/event
- agent/tags
- agent/trending
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/18.04
- version/ubuntu ubuntu/16.04
- version/ubuntu ubuntu/14.04