Security Bulletin: Vulnerabilities in Linux Kernel might affect IBM Spectrum Copy Data Management (CVE-2022-2964, CVE-2022-2601, CVE-2020-36557)

Summary

Vulnerabilities in Linux Kernel might affect IBM Spectrum Copy Data Management. Vulnerabilities include the execution of arbitrary code on the system, heap-based buffer overflow, denial of service attack, as described by the CVEs in the “Vulnerability Details” section.

Vulnerability Details

CVEID:CVE-2022-2964
**DESCRIPTION:**Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by multiple out-of-bounds reads and possible out-of-bounds writes flaw in the driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235652 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2022-2601
**DESCRIPTION:**Linux Kernel is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the grub_font_construct_glyph function in grub2. By using a specially-crafted pf2 font, a local authenticated attacker could overflow a buffer and execute arbitrary code or cause a denial of service condition on the system.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/242591 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:CVE-2020-36557
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by a race condition in VT_DISALLOCATE. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/231893 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

IBM Spectrum Copy Data Management****Affected Versions|**Fixing
**Level|Platform|**Link to Fix and Instructions
**
—|—|—|—
2.2.0.0 - 2.2.18.0| 2.2.19.0| Linux| <https://www.ibm.com/support/pages/node/6910003&gt;

Workarounds and Mitigations

None