logo
DATABASE RESOURCES PRICING ABOUT US

USN-5091-1: Linux kernel vulnerabilities | Cloud Foundry

Description

## Severity Medium ## Vendor Canonical Ubuntu ## Versions Affected * Canonical Ubuntu 18.04 ## Description Several security issues were fixed in the Linux kernel. Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. (CVE-2021-33624) It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679) Alexey Kardashevskiy discovered that the KVM implementation for PowerPC systems in the Linux kernel did not properly validate RTAS arguments in some situations. An attacker in a guest vm could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code. (CVE-2021-37576) It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160) Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199) It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204) CVEs contained in this USN include: CVE-2021-38160, CVE-2021-33624, CVE-2021-3679, CVE-2021-37576, CVE-2021-38199, CVE-2021-38204. ## Affected Cloud Foundry Products and Versions _Severity is medium unless otherwise noted._ * Bionic Stemcells * 1.x versions prior to 1.33 * All other stemcells not listed. ## Mitigation Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases: * Bionic Stemcells * Upgrade 1.x versions to 1.33 or greater * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells>). ## References * [USN Notice](<https://ubuntu.com/security/notices/USN-5091-1>) * [CVE-2021-38160](<https://people.canonical.com/~ubuntu-security/cve/CVE-2021-38160>) * [CVE-2021-33624](<https://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-33624.html>) * [CVE-2021-3679](<https://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-3679.html>) * [CVE-2021-37576](<https://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-37576.html>) * [CVE-2021-38199](<https://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-38199.html>) * [CVE-2021-38204](<https://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-38204.html>) ## History 2021-10-04: Initial vulnerability report published.


Affected Software


CPE Name Name Version
bionic stemcells 1.33

Related