Debian DLA-2557-1 : linux-4.19 security update

high Nessus Plugin ID 146512
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Debian host is missing a security update.

Description

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2020-27815

A flaw was reported in the JFS filesystem code allowing a local attacker with the ability to set extended attributes to cause a denial of service.

CVE-2020-27825

Adam 'pi3' Zabrocki reported a use-after-free flaw in the ftrace ring buffer resizing logic due to a race condition, which could result in denial of service or information leak.

CVE-2020-27830

Shisong Qin reported a NULL pointer dereference flaw in the Speakup screen reader core driver.

CVE-2020-28374

David Disseldorp discovered that the LIO SCSI target implementation performed insufficient checking in certain XCOPY requests. An attacker with access to a LUN and knowledge of Unit Serial Number assignments can take advantage of this flaw to read and write to any LIO backstore, regardless of the SCSI transport settings.

CVE-2020-29568 (XSA-349)

Michael Kurth and Pawel Wieczorkiewicz reported that frontends can trigger OOM in backends by updating a watched path.

CVE-2020-29569 (XSA-350)

Olivier Benjamin and Pawel Wieczorkiewicz reported a use-after-free flaw which can be triggered by a block frontend in Linux blkback. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend.

CVE-2020-29660

Jann Horn reported a locking inconsistency issue in the tty subsystem which may allow a local attacker to mount a read-after-free attack against TIOCGSID.

CVE-2020-29661

Jann Horn reported a locking issue in the tty subsystem which can result in a use-after-free. A local attacker can take advantage of this flaw for memory corruption or privilege escalation.

CVE-2020-36158

A buffer overflow flaw was discovered in the mwifiex WiFi driver which could result in denial of service or the execution of arbitrary code via a long SSID value.

CVE-2021-3347

It was discovered that PI futexes have a kernel stack use-after-free during fault handling. An unprivileged user could use this flaw to crash the kernel (resulting in denial of service) or for privilege escalation.

CVE-2021-20177

A flaw was discovered in the Linux implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) can take advantage of this flaw to cause a kernel panic when inserting iptables rules.

For Debian 9 stretch, these problems have been fixed in version 4.19.171-2~deb9u1.

We recommend that you upgrade your linux-4.19 packages.

For the detailed security status of linux-4.19 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux-4.19

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected packages.

See Also

https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html

https://packages.debian.org/source/stretch/linux-4.19

https://security-tracker.debian.org/tracker/source-package/linux-4.19

Plugin Details

Severity: High

ID: 146512

File Name: debian_DLA-2557.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2/16/2021

Updated: 2/19/2021

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2021-3347

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:POC/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:linux-config-4.19, p-cpe:/a:debian:debian_linux:linux-doc-4.19, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-686, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-686-pae, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-all, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-all-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-all-arm64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-all-armel, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-all-armhf, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-all-i386, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-arm64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-armmp, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-armmp-lpae, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-cloud-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-common, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-common-rt, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-marvell, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-rpi, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-rt-686-pae, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-rt-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-rt-arm64, p-cpe:/a:debian:debian_linux:linux-headers-4.19.0-0.bpo.10-rt-armmp, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-686, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-686-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-686-pae, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-686-pae-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-amd64, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-amd64-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-arm64, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-arm64-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-armmp, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-armmp-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-armmp-lpae, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-armmp-lpae-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-cloud-amd64, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-cloud-amd64-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-marvell, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-marvell-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rpi, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rpi-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-686-pae, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-686-pae-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-amd64, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-amd64-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-arm64, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-arm64-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-armmp, p-cpe:/a:debian:debian_linux:linux-image-4.19.0-0.bpo.10-rt-armmp-dbg, p-cpe:/a:debian:debian_linux:linux-kbuild-4.19, p-cpe:/a:debian:debian_linux:linux-perf-4.19, p-cpe:/a:debian:debian_linux:linux-source-4.19, p-cpe:/a:debian:debian_linux:linux-support-4.19.0-0.bpo.10, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/12/2021

Vulnerability Publication Date: 12/9/2020

Reference Information

CVE: CVE-2020-27815, CVE-2020-27825, CVE-2020-27830, CVE-2020-28374, CVE-2020-29568, CVE-2020-29569, CVE-2020-29660, CVE-2020-29661, CVE-2020-36158, CVE-2021-20177, CVE-2021-3347