QID 198518

Date Published: 2021-10-06

QID 198518: Ubuntu Security Notification for Linux kernel (Raspberry Pi) Vulnerabilities (USN-5094-2)

The kvm hypervisor implementation in the linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability.
The tracing subsystem in the linux kernel did not properly keep track of per-cpu ring buffer state.
The overlay file system in the linux kernel did not restrict private clones in some situations.
The max-3421 host usb device driver in the linux kernel did not properly handle device removal events.
The xilinx 10/100 ethernet lite device driver in the linux kernel could report pointer addresses in some situations.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

an attacker who could start and control a vm could possibly use this to expose sensitive information or execute arbitrary code. (
Cve-2021-22543).
A privileged attacker could use this to cause a denial of service. (
Cve-2021-3679).
An attacker could use this to expose sensitive information. (
Cve-2021-3732).
A physically proximate attacker could use this to cause a denial of service (system crash) (cve-2021-38204).
An attacker could use this information to ease the exploitation of another vulnerability. (
Cve-2021-38205).

  • CVSS V3 rated as High - 7.8 severity.
  • CVSS V2 rated as Medium - 4.6 severity.
  • Solution
    Refer to Ubuntu advisory: USN-5094-2 for affected packages and patching details, or update with your package manager.
    Vendor References
    Software Advisories
    Advisory ID Software Component Link
    USN-5094-2 Ubuntu Linux URL Logo ubuntu.com/security/notices/USN-5094-2