USN-4983-1

Dashboard / Vulnerabilities / USN-4983-1

USN-4983-1

Summary: linux-oem-5.10 vulnerabilities

Details: Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel did not properly enforce limits for pointer operations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33200) Piotr Krysiuk and Benedict Schlueter discovered that the eBPF implementation in the Linux kernel performed out of bounds speculation on pointer arithmetic. A local attacker could use this to expose sensitive information. (CVE-2021-29155) Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel did not properly prevent speculative loads in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2021-31829) Reiji Watanabe discovered that the KVM VMX implementation in the Linux kernel did not properly prevent user space from tampering with an array index value, leading to a potential out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3501)

References: https://ubuntu.com/security/notices/USN-4983-1, https://ubuntu.com/security/CVE-2021-3501, https://ubuntu.com/security/CVE-2021-29155, https://ubuntu.com/security/CVE-2021-31829, https://ubuntu.com/security/CVE-2021-33200