SB2022012119 - Debian update for linux
Published: January 21, 2022 Updated: August 21, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2021-28711)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Resource exhaustion (CVE-ID: CVE-2021-28712)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Resource exhaustion (CVE-ID: CVE-2021-28713)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Improper Resource Shutdown or Release (CVE-ID: CVE-2021-28714)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Improper Resource Shutdown or Release (CVE-ID: CVE-2021-28715)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Buffer overflow (CVE-ID: CVE-2021-39685)
The vulnerability allows a malicious host to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the USB subsystem in Linux kernel. A malicious USB device can trigger memory corruption and execute arbitrary code on the system.
7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-4155)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to the OS kernel does not impose correctly security restrictions. A local user can gain access to sensitive information on the system.
8) Information disclosure (CVE-ID: CVE-2021-45095)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a refcount leak within the pep_sock_accept() function in net/phonet/pep.c in the Linux kernel. A local user can gain unauthorized access to sensitive information on the system.
9) Out-of-bounds read (CVE-ID: CVE-2021-45469)
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to a boundary condition in the __f2fs_setxattr() function in fs/f2fs/xattr.c in the Linux kernel when an inode has an invalid last xattr entry. A local user can create a specially crafted f2fs image, trigger an out-of-bounds read error, and perform a denial of service attack or possibly execute arbitrary code.
10) Memory leak (CVE-ID: CVE-2021-45480)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the __rds_conn_create() function in net/rds/connection.c. A local user can perform a denial of service attack.
11) Integer overflow (CVE-ID: CVE-2022-0185)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow in the legacy_parse_param() function in fs/fs_context.c in Linux kernel. A local user can tun a specially crafted program to trigger integer overflow and execute arbitrary code with root privileges.
12) Security restrictions bypass (CVE-ID: CVE-2022-23222)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to availability of pointer arithmetic via certain *_OR_NULL pointer types in kernel/bpf/verifier.c in the Linux kernel. A local user can run a specially crafted program to execute arbitrary code with root privileges.
Remediation
Install update from vendor's website.