Detections
Analytics

Ubuntu 20.10 : Linux kernel vulnerabilities (USN-4659-1)

high Nessus Plugin ID 143429

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4659-1 advisory.

 - In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
 A-161151868References: N/A (CVE-2020-0423)

 - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
 (CVE-2020-4788)

 - Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key. (CVE-2020-10135)

 - A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.
 Kernel versions before 5.10 may be vulnerable to this issue. (CVE-2020-25705)

 - An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9. (CVE-2020-27152)

 - A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def. (CVE-2020-28915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-4659-1

Plugin Details

Severity: High

ID: 143429

File Name: ubuntu_USN-4659-1.nasl

Version: 1.6

Type: local

Agent: unix

Published: 12/2/2020

Updated: 2/7/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-0423

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2020-14351

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:20.10, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1008-raspi, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1008-raspi-nolpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1011-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1011-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1012-gcp, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1013-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-1014-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-31-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-31-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-31-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.8.0-31-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-64k-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-64k-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-gke, p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-oem-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi, p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi-nolpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-20.04-edge

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/2/2020

Vulnerability Publication Date: 5/19/2020

Reference Information

CVE: CVE-2020-0423, CVE-2020-10135, CVE-2020-14351, CVE-2020-25705, CVE-2020-27152, CVE-2020-28915, CVE-2020-4788

USN: 4659-1