by 
A bunch of new Linux kernel vulnerabilities were patched today in all supported Ubuntu releases, along with a regression introduced by a kernel update in October 2020.
It would appear that a serious vulnerability is affecting most GNU/Linux distributions running a Linux kernel before version 5.10.7. The flaw (CVE-2020-28374) was discovered in Linux kernel’s LIO SCSI target implementation and could allow a remote attacker with access to at least one iSCSI LUN in a multiple backstore environment to expose sensitive information or modify data.
“In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3,” reads the security advisory.
This flaw was patched today in Ubuntu 20.10 (Groovy Gorilla) systems running Linux kernel 5.8, Ubuntu 20.04 LTS (Focal Fossa) systems running Linux kernel 5.4, Ubuntu 18.04 LTS (Bionic Beaver) systems running Linux kernel 5.4 or 4.15, as well as Ubuntu 16.04 LTS (Xenial Xerus) and Ubuntu 14.04 ESM systems running Linux kernel 4.4.
Of course, this flaw affects many other Ubuntu-based distribution derived from the ones mentioned above, as well as Debian GNU/Linux 9 “Stretch” systems running Linux kernel 4.9 and Debian GNU/Linux 10 “Buster” systems running Linux kernel 4.19, as well as Red Hat Enterprise Linux, CentOS, SUSE, and Fedora Linux systems.
It should be noted that the flaw only affects the Linux kernels for Raspberry Pi (V8) systems, Amazon Web Services (AWS), systems, Google Cloud Platform (GCP) systems, Microsoft Azure Cloud systems, Oracle Cloud systems, and cloud environments (KVM). Users are urged to update their installations as soon as possible to the new kernel versions available in the stable software repositories.
In addition, Ubuntu 18.04 LTS (Bionic Beaver) systems running Linux kernel 4.15 (on all supported architectures) were affected by a memory leak flaw in the Linux kernel performance monitoring (perf) subsystem, which could allow a privileged local attacker to cause a denial of service (kernel memory exhaustion). More details are available at CVE-2020-25704.
Furthermore, Ubuntu 16.04 LTS and Ubuntu 14.04 ESM systems running Linux kernel 4.4 were plagued by several more security issues, including CVE-2018-13093, a flaw discovered by Wen Xu in the XFS file system implementation, as well as CVE-2019-19813 and CVE-2019-19816, two flaws discovered in the Btrfs file system implementation. These vulnerabilities could allow an attacker to cause a denial of service (system crash) by using malicious XFS or Btrfs images.
Ubuntu 16.04 LTS and Ubuntu 14.04 ESM systems were also affected by two other flaws, namely CVE-2020-25669, a use-after-free discovered by Bodong Zhao in Linux kernel’s Sun keyboard driver implementation, which could allow a local attacker to cause a denial of service or execute arbitrary code, and CVE-2020-27777, a vulnerability discovered by Daniel Axtens in Linux kernel’s PowerPC RTAS implementation, which could allow a privileged local attacker to arbitrarily modify kernel memory, potentially bypassing kernel lockdown restrictions.
Also today, Canonical published a Linux kernel update for Ubuntu 20.10 systems running Linux kernel 5.8 and Ubuntu 20.04 LTS systems running Linux kernel 5.4 LTS that fixes a regression introduced by a kernel update released on October 14th, 2020. The regression could incorrectly deny access to overlay files in some situations. Therefore, users are urged to update their systems to linux-image 5.8.0-41.46 on Ubuntu 20.10 and linux-image 5.4.0-65.73 on Ubuntu 20.04 LTS as soon as possible.
Last updated 3 years ago
