USN-5015-1

Dashboard / Vulnerabilities / USN-5015-1

USN-5015-1

Summary: linux-oem-5.10 vulnerabilities

Details: It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-33909) Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691) It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564) It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573) It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-3587)

References: https://ubuntu.com/security/notices/USN-5015-1, https://ubuntu.com/security/CVE-2021-3564, https://ubuntu.com/security/CVE-2021-3573, https://ubuntu.com/security/CVE-2021-3587, https://ubuntu.com/security/CVE-2021-28691, https://ubuntu.com/security/CVE-2021-33909