USN-5605-1: Linux kernel (Azure CVM) vulnerabilities
Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061) It was discovered that the virtual terminal driver in the Linux kernel did not properly handle VGA console font changes, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33656)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-azure-fdeto a version that resolves this vulnerability.Fixed in 5.4.0.1090.95+cvm1.30 - Upgrade
Upgrade
ubuntu/linux-image-5.4.0-1090-azure-fdeto a version that resolves this vulnerability.Fixed in 5.4.0-1090.95+cvm1.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2021-33061.
How can a local attacker exploit this vulnerability?
A local attacker could exploit this vulnerability by performing insufficient control flow management in the Intel 10GbE PCI Express Ethernet driver, potentially causing a denial of service.
What is the remedy for this vulnerability?
The recommended remedy for this vulnerability is to update the Linux kernel to version 5.4.0.1090.95+cvm1.30 or later.
Is Ubuntu affected by this vulnerability?
Yes, Ubuntu 20.04 is affected by this vulnerability.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the references provided: [CVE-2021-33656](https://ubuntu.com/security/CVE-2021-33656), [CVE-2021-33061](https://ubuntu.com/security/CVE-2021-33061), [USN-5580-1](https://ubuntu.com/security/notices/USN-5580-1)