USN-5596-1: Linux kernel (OEM) vulnerabilities
Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061) It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2021-33061.
What is the affected software for this vulnerability?
The affected software for this vulnerability is the Linux kernel, specifically the linux-image-oem-22.04 and linux-image-oem-22.04a packages with versions up to and excluding 5.17.0.1016.15, and the linux-image-5.17.0-1016-oem package with versions up to and excluding 5.17.0-1016.17.
What is the severity of CVE-2021-33061?
The severity of CVE-2021-33061 is not specified in the advisory.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by performing insufficient control flow management in the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver, leading to a possible denial of service.
How can I fix CVE-2021-33061?
To fix CVE-2021-33061, update the linux-image-oem-22.04 and linux-image-oem-22.04a packages to version 5.17.0.1016.15 or later, and update the linux-image-5.17.0-1016-oem package to version 5.17.0-1016.17 or later.