Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2020-27067: Linux kernels on cloud and Xenial can raise privileges
CVE-2020-27067 · published 5 years ago
Summary
A timing flaw in the L2TP networking component of certain Linux kernels (used in AWS, Azure, GCP and Ubuntu Xenial) can let a local attacker gain full system rights without any user interaction. This occurs because the code may use memory that has already been released. Install the latest kernel updates from your Linux distribution to fix the problem.
What to do
- Update canonical linux-aws to version 4.4.0-1075.79.
- Update canonical linux-lts-xenial to version 4.4.0-186.216~14.04.1.
- Update canonical linux to version 4.4.0-186.216.
- Update canonical linux-aws to version 4.4.0-1111.123.
- Update canonical linux-azure to version 4.15.0-1013.13~16.04.2.
- Update canonical linux-gcp to version 4.15.0-1014.14~16.04.1.
- Update canonical linux-hwe to version 4.15.0-24.26~16.04.1.
- Update canonical linux-kvm to version 4.4.0-1077.84.
- Update canonical linux-raspi2 to version 4.4.0-1136.145.
- Update canonical linux-snapdragon to version 4.4.0-1140.148.
- Update canonical linux-fips to version 4.4.0-1043.48.
- Update canonical linux-snapdragon to version 4.15.0-1053.57.
- Update debian linux to version 4.15.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws |
< 4.4.0-1075.79 Fix: upgrade to 4.4.0-1075.79
|
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial |
< 4.4.0-186.216~14.04.1 Fix: upgrade to 4.4.0-186.216~14.04.1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:16.04:LTS | canonical | linux |
< 4.4.0-186.216 Fix: upgrade to 4.4.0-186.216
|
| Ubuntu:16.04:LTS | canonical | linux-aws |
< 4.4.0-1111.123 Fix: upgrade to 4.4.0-1111.123
|
| Ubuntu:16.04:LTS | canonical | linux-azure |
< 4.15.0-1013.13~16.04.2 Fix: upgrade to 4.15.0-1013.13~16.04.2
|
| Ubuntu:16.04:LTS | canonical | linux-gcp |
< 4.15.0-1014.14~16.04.1 Fix: upgrade to 4.15.0-1014.14~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-hwe |
< 4.15.0-24.26~16.04.1 Fix: upgrade to 4.15.0-24.26~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-kvm |
< 4.4.0-1077.84 Fix: upgrade to 4.4.0-1077.84
|
| Ubuntu:16.04:LTS | canonical | linux-raspi2 |
< 4.4.0-1136.145 Fix: upgrade to 4.4.0-1136.145
|
| Ubuntu:16.04:LTS | canonical | linux-snapdragon |
< 4.4.0-1140.148 Fix: upgrade to 4.4.0-1140.148
|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips |
< 4.4.0-1043.48 Fix: upgrade to 4.4.0-1043.48
|
| Ubuntu:18.04:LTS | canonical | linux-snapdragon |
< 4.15.0-1053.57 Fix: upgrade to 4.15.0-1053.57
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Debian:12 | debian | linux |
< 4.15.4-1 Fix: upgrade to 4.15.4-1
|
| – | android |
All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:* |
Original advisory text
In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not ...
In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152409173
References
- https://security-tracker.debian.org/tracker/CVE-2020-27067 Vendor Advisory
- https://ubuntu.com/security/CVE-2020-27067 Third Party Advisory
- https://source.android.com/security/bulletin/pixel/2020-12-01 Third Party Advisory
- https://salsa.debian.org/kernel-team/kernel-sec/-/blob/master/retired/CVE-2020-2... Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-27067 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-362Race Condition
CWE-416Use After Free
Timeline
Published15 Dec 2020
Updated28 Oct 2026
First seen17 Aug 2026
Track software like this
Free during beta