- Canonical Ubuntu 18.04
Several security issues were fixed in the Linux kernel.
Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk
discovered that the BPF verifier in the Linux kernel missed possible
mispredicted branches due to type confusion, allowing a side-channel
attack. An attacker could use this to expose sensitive information.
It was discovered that the tracing subsystem in the Linux kernel did not
properly keep track of per-cpu ring buffer state. A privileged attacker
could use this to cause a denial of service. (CVE-2021-3679)
Alexey Kardashevskiy discovered that the KVM implementation for PowerPC
systems in the Linux kernel did not properly validate RTAS arguments in
some situations. An attacker in a guest vm could use this to cause a denial
of service (host OS crash) or possibly execute arbitrary code.
It was discovered that the Virtio console implementation in the Linux
kernel did not properly validate input lengths in some situations. A local
attacker could possibly use this to cause a denial of service (system
Michael Wakabayashi discovered that the NFSv4 client implementation in the
Linux kernel did not properly order connection setup operations. An
attacker controlling a remote NFS server could use this to cause a denial
of service on the client. (CVE-2021-38199)
It was discovered that the MAX-3421 host USB device driver in the Linux
kernel did not properly handle device removal events. A physically
proximate attacker could use this to cause a denial of service (system
CVEs contained in this USN include: CVE-2021-38160, CVE-2021-33624, CVE-2021-3679, CVE-2021-37576, CVE-2021-38199, CVE-2021-38204.
Affected Cloud Foundry Products and Versions
Severity is medium unless otherwise noted.
- Bionic Stemcells
- 1.x versions prior to 1.33
- All other stemcells not listed.
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- Bionic Stemcells
- Upgrade 1.x versions to 1.33 or greater
- All other stemcells should be upgraded to the latest version available on bosh.io.
2021-10-04: Initial vulnerability report published.