Ubuntu 20.04 LTS / 21.04 : Linux kernel vulnerabilities (USN-5092-2)

high Nessus Plugin ID 153799

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 20.04 LTS / 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5092-2 advisory.

 - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
 (CVE-2021-3679)

 - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

 - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

 - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.
 (CVE-2021-35477)

 - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
 (CVE-2021-37159)

 - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

 - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
 the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
 (CVE-2021-38160)

 - fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection. (CVE-2021-38199)

 - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
 (CVE-2021-38201)

 - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations. (CVE-2021-38204)

 - drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer). (CVE-2021-38205)

 - loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc//maps for exploitation. (CVE-2021-41073)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-5092-2

Plugin Details

Severity: High

ID: 153799

File Name: ubuntu_USN-5092-2.nasl

Version: 1.2

Type: local

Agent: unix

Published: 9/30/2021

Updated: 9/30/2021

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information

CVSS Score Source: CVE-2021-38160

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:21.04, p-cpe:/a:canonical:ubuntu_linux:linux-azure, p-cpe:/a:canonical:ubuntu_linux:linux-azure-5.11-cloud-tools-5.11.0-1017, p-cpe:/a:canonical:ubuntu_linux:linux-azure-5.11-headers-5.11.0-1017, p-cpe:/a:canonical:ubuntu_linux:linux-azure-5.11-tools-5.11.0-1017, p-cpe:/a:canonical:ubuntu_linux:linux-azure-cloud-tools-5.11.0-1017, p-cpe:/a:canonical:ubuntu_linux:linux-azure-edge, p-cpe:/a:canonical:ubuntu_linux:linux-azure-headers-5.11.0-1017, p-cpe:/a:canonical:ubuntu_linux:linux-azure-tools-5.11.0-1017, p-cpe:/a:canonical:ubuntu_linux:linux-buildinfo-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-buildinfo-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-buildinfo-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-buildinfo-5.11.0-37-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-buildinfo-5.11.0-37-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-buildinfo-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-azure, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-azure-edge, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-generic-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-generic-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-lowlatency-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-lowlatency-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-cloud-tools-virtual-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-generic-64k-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-generic-64k-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-generic-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-generic-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-generic-lpae-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-generic-lpae-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-headers-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-headers-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-headers-5.11.0-37-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-headers-5.11.0-37-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-headers-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-headers-azure, p-cpe:/a:canonical:ubuntu_linux:linux-headers-azure-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-generic-64k-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-headers-generic-64k-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-generic-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-headers-generic-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-generic-lpae-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-headers-generic-lpae-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-lowlatency-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-headers-lowlatency-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-headers-oracle-edge, p-cpe:/a:canonical:ubuntu_linux:linux-headers-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-headers-virtual-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-cloud-tools-5.11.0-37, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-cloud-tools-common, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-headers-5.11.0-37, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-source-5.11.0, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-tools-5.11.0-37, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-tools-common, p-cpe:/a:canonical:ubuntu_linux:linux-hwe-5.11-tools-host, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.11.0-37-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.11.0-37-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-azure-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-extra-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-extra-virtual-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-64k-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-64k-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle-edge, p-cpe:/a:canonical:ubuntu_linux:linux-image-unsigned-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-unsigned-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-image-unsigned-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-unsigned-5.11.0-37-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-image-unsigned-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-lowlatency-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-lowlatency-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-modules-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-modules-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-modules-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-modules-5.11.0-37-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-modules-5.11.0-37-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-modules-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-modules-extra-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-modules-extra-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-modules-extra-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-modules-extra-azure, p-cpe:/a:canonical:ubuntu_linux:linux-modules-extra-azure-edge, p-cpe:/a:canonical:ubuntu_linux:linux-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-oracle-5.11-headers-5.11.0-1019, p-cpe:/a:canonical:ubuntu_linux:linux-oracle-5.11-tools-5.11.0-1019, p-cpe:/a:canonical:ubuntu_linux:linux-oracle-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-5.11.0-1017-azure, p-cpe:/a:canonical:ubuntu_linux:linux-tools-5.11.0-1019-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-tools-5.11.0-37-generic, p-cpe:/a:canonical:ubuntu_linux:linux-tools-5.11.0-37-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-tools-5.11.0-37-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-tools-5.11.0-37-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-tools-azure, p-cpe:/a:canonical:ubuntu_linux:linux-tools-azure-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-generic-64k-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-tools-generic-64k-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-generic-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-tools-generic-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-generic-lpae-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-tools-generic-lpae-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-lowlatency-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-tools-lowlatency-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-tools-oracle-edge, p-cpe:/a:canonical:ubuntu_linux:linux-tools-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-tools-virtual-hwe-20.04-edge, p-cpe:/a:canonical:ubuntu_linux:linux-virtual-hwe-20.04, p-cpe:/a:canonical:ubuntu_linux:linux-virtual-hwe-20.04-edge

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 9/29/2021

Vulnerability Publication Date: 6/23/2021

Reference Information

CVE: CVE-2021-3679, CVE-2021-33624, CVE-2021-34556, CVE-2021-35477, CVE-2021-37159, CVE-2021-37576, CVE-2021-38160, CVE-2021-38199, CVE-2021-38201, CVE-2021-38204, CVE-2021-38205, CVE-2021-41073

USN: 5092-2