USN-5091-1: Linux kernel vulnerabilities | Cloud Foundry

Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 18.04

Description

Several security issues were fixed in the Linux kernel.

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk

discovered that the BPF verifier in the Linux kernel missed possible

mispredicted branches due to type confusion, allowing a side-channel

attack. An attacker could use this to expose sensitive information.

(CVE-2021-33624)

It was discovered that the tracing subsystem in the Linux kernel did not

properly keep track of per-cpu ring buffer state. A privileged attacker

could use this to cause a denial of service. (CVE-2021-3679)

Alexey Kardashevskiy discovered that the KVM implementation for PowerPC

systems in the Linux kernel did not properly validate RTAS arguments in

some situations. An attacker in a guest vm could use this to cause a denial

of service (host OS crash) or possibly execute arbitrary code.

(CVE-2021-37576)

It was discovered that the Virtio console implementation in the Linux

kernel did not properly validate input lengths in some situations. A local

attacker could possibly use this to cause a denial of service (system

crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the

Linux kernel did not properly order connection setup operations. An

attacker controlling a remote NFS server could use this to cause a denial

of service on the client. (CVE-2021-38199)

It was discovered that the MAX-3421 host USB device driver in the Linux

kernel did not properly handle device removal events. A physically

proximate attacker could use this to cause a denial of service (system

crash). (CVE-2021-38204)

CVEs contained in this USN include: CVE-2021-38160, CVE-2021-33624, CVE-2021-3679, CVE-2021-37576, CVE-2021-38199, CVE-2021-38204.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• Bionic Stemcells
  • 1.x versions prior to 1.33
  • All other stemcells not listed.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Bionic Stemcells
  • Upgrade 1.x versions to 1.33 or greater
  • All other stemcells should be upgraded to the latest version available on bosh.io.

References

• USN Notice
• CVE-2021-38160
• CVE-2021-33624
• CVE-2021-3679
• CVE-2021-37576
• CVE-2021-38199
• CVE-2021-38204

History

2021-10-04: Initial vulnerability report published.