QID 198464

Date Published: 2021-08-24

QID 198464: Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5045-1)

The can broadcast manger (bcm) protocol implementation in the linux kernel did not properly initialize memory in some situations.
The bluetooth subsystem in the linux kernel did not properly handle hci device initialization failure, leading to a double-free vulnerability.
The bluetooth subsystem in the linux kernel did not properly handle hci device detach events, leading to a use-after-free vulnerability.
The nfc implementation in the linux kernel did not properly handle failed connect events leading to a null pointer dereference.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

a local attacker could use this to expose sensitive information (kernel memory) (cve-2021-34693).
An attacker could use this to cause a denial of service or possibly execute arbitrary code. (
Cve-2021-3564).
An attacker could use this to cause a denial of service or possibly execute arbitrary code. (
Cve-2021-3573).
A local attacker could use this to cause a denial of service.
(cve-2021-3587).

  • CVSS V3 rated as High - 6.4 severity.
  • CVSS V2 rated as High - 6.9 severity.
  • Solution
    Refer to Ubuntu advisory: USN-5045-1 for affected packages and patching details, or update with your package manager.
    Vendor References

    CVEs related to QID 198464

    Software Advisories
    Advisory ID Software Component Link
    USN-5045-1 Ubuntu Linux URL Logo usn.ubuntu.com/5045-1