Linux kernel vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• linux - Linux kernel
• linux-aws - Linux kernel for Amazon Web Services (AWS) systems
• linux-aws-5.4 - Linux kernel for Amazon Web Services (AWS) systems
• linux-azure - Linux kernel for Microsoft Azure Cloud systems
• linux-azure-5.4 - Linux kernel for Microsoft Azure cloud systems
• linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
• linux-gcp-5.4 - Linux kernel for Google Cloud Platform (GCP) systems
• linux-hwe-5.4 - Linux hardware enablement (HWE) kernel
• linux-kvm - Linux kernel for cloud environments
• linux-oracle - Linux kernel for Oracle Cloud systems
• linux-oracle-5.4 - Linux kernel for Oracle Cloud systems
• linux-raspi - Linux kernel for Raspberry Pi (V8) systems
• linux-raspi-5.4 - Linux kernel for Raspberry Pi (V8) systems

Details

Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)

Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)

David Alan Gilbert discovered that the XFS file system implementation in
the Linux kernel did not properly perform metadata validation in some
circumstances. A local attacker could use this to cause a denial of
service. (CVE-2020-14385)

Giuseppe Scrivano discovered that the overlay file system in the Linux
kernel did not properly perform permission checks in some situations. A
local attacker could possibly use this to bypass intended restrictions and
gain read access to restricted files. (CVE-2020-16120)

It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)

It was discovered that the block layer subsystem in the Linux kernel did
not properly handle zero-length requests. A local attacker could use this
to cause a denial of service. (CVE-2020-25641)