USN-5603-1: Linux kernel (Raspberry Pi) vulnerabilities
Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061) It was discovered that the virtual terminal driver in the Linux kernel did not properly handle VGA console font changes, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33656)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-raspi-hwe-18.04to a version that resolves this vulnerability.Fixed in 5.4.0.1069.69 - Upgrade
Upgrade
ubuntu/linux-image-5.4.0-1069-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1069.79~18.04.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2021-33061.
What is the severity of CVE-2021-33061?
The severity of CVE-2021-33061 is not specified in the advisory.
How can a local attacker exploit CVE-2021-33061?
A local attacker can exploit CVE-2021-33061 to cause a denial of service.
Which versions of Linux kernel are affected by CVE-2021-33061?
CVE-2021-33061 affects Linux kernel versions 5.4.0.1069.69 and 5.4.0-1069.79~18.04.1.
What is the remedy for CVE-2021-33061?
The remedy for CVE-2021-33061 is to update the Linux kernel packages to version 5.4.0.1069.69 or 5.4.0-1069.79~18.04.1.