QID 198707

Date Published: 2022-03-23

QID 198707: Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5339-1)

The cgroups implementation in thelinux kernel did not properly restrict access to the cgroups v1release_agent feature.
An out-of-bounds (oob) memory access flaw existed inthe f2fs module of the linux kernel.
The marvell wifi-ex usb device driverin the linux kernel did not properly handle some error conditions.
The arm trusted execution environment (tee)subsystem in the linux kernel contained a race condition leading to a use-after-free vulnerability.
The phone network protocol (phonet) implementationin the linux kernel did not properly perform reference counting in someerror conditions.
The transparent inter-process communication(tipc) protocol implementation in the linux kernel contained a stack-basedbuffer overflow.

A local attacker could use this to gainadministrative privileges.
A local attacker could use this issueto cause a denial of service (system crash).
Aphysically proximate attacker could use this to cause a denial of service(system crash).
A local attacker could use this to cause a denialof service or possibly execute arbitrary code.
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A remote attacker could use this to cause a denial ofservice (system crash) for systems that have a tipc bearer configured.

  • CVSS V3 rated as High - 7.8 severity.
  • CVSS V2 rated as Medium - 5.6 severity.
  • Solution
    Refer to Ubuntu security advisory USN-5339-1 for updates and patch information.
    Vendor References
    Software Advisories
    Advisory ID Software Component Link
    USN-5339-1 Ubuntu Linux URL Logo ubuntu.com/security/notices/USN-5339-1