[LSN-0081-1] Linux kernel vulnerability

Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 20.04 LTS – Ubuntu 18.04 LTS – Ubuntu 16.04 ESM – Ubuntu 14.04 ESM
Summary
Several security issues were fixed in the kernel.
Software Description
– linux – Linux kernel – linux-gcp – Linux kernel for Google Cloud Platform (GCP) systems – linux-gke – Linux kernel for Google Container Engine (GKE) systems – linux-gkeop – Linux kernel for Google Container Engine (GKE) systems – linux-oem – Linux kernel for OEM systems
Details
Maxim Levitsky discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not properly prevent a guest VM from enabling AVIC in nested guest VMs. An attacker in a guest VM could use this to write to portions of the host’s physical memory. (CVE-2021-3653)
Maxim Levitsky and Paolo Bonzini discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel allowed a guest VM to disable restrictions on VMLOAD/VMSAVE in a nested guest. An attacker in a guest VM could use this to read or write portions of the host’s physical memory. (CVE-2021-3656)
Andy Nguyen discovered that the netfilter subsystem in the Linux kernel contained an out-of-bounds write in its setsockopt() implementation. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22555)
It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-33909)
Update instructions
The problem can be corrected by updating your kernel livepatch to the following versions:
Ubuntu 20.04 LTS gcp – 81.1 generic – 81.1 gke – 81.1 gkeop – 81.1 lowlatency – 81.1
Ubuntu 18.04 LTS generic – 81.1 gke – 81.1 gkeop – 81.1 lowlatency – 81.1 oem – 81.1
Ubuntu 16.04 ESM generic – 81.1 lowlatency – 81.1
Ubuntu 14.04 ESM generic – 81.1 lowlatency – 81.1
Support Information
Kernels older than the levels listed below do not receive livepatch updates. If you are running a kernel version earlier than the one listed below, please upgrade your kernel as soon as possible.
Ubuntu 20.04 LTS linux-aws – 5.4.0-1009 linux-azure – 5.4.0-1010 linux-gcp – 5.4.0-1009 linux-gke – 5.4.0-1033 linux-gkeop – 5.4.0-1009 linux-oem – 5.4.0-26 linux – 5.4.0-26
Ubuntu 18.04 LTS linux-aws – 4.15.0-1054 linux-gke-4.15 – 4.15.0-1076 linux-gke-5.4 – 5.4.0-1009 linux-gkeop-5.4 – 5.4.0-1007 linux-hwe-5.4 – 5.4.0-26 linux-oem – 4.15.0-1063 linux – 4.15.0-69
Ubuntu 16.04 ESM linux-aws – 4.4.0-1098 linux-azure – 4.15.0-1063 linux-azure – 4.15.0-1078 linux-hwe – 4.15.0-69 linux – 4.4.0-168 linux – 4.4.0-211
Ubuntu 14.04 ESM linux-lts-xenial – 4.4.0-168
References
– CVE-2021-3653 – CVE-2021-3656 – CVE-2021-22555 – CVE-2021-33909