Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel bugs could crash servers or permit code execution
published 6 years ago
Summary
Multiple flaws in the Linux operating system affect its network handling and file system components. These weaknesses could let someone with access to the machine cause a system crash or, in some cases, run their own code. Apply the latest security updates from your Linux vendor to protect your systems.
What to do
- Update canonical linux-aws to version 4.4.0-1081.85.
- Update canonical linux-lts-xenial to version 4.4.0-193.224~14.04.1.
- Update canonical linux to version 4.4.0-193.224.
- Update canonical linux-aws to version 4.4.0-1117.131.
- Update canonical linux-kvm to version 4.4.0-1082.91.
- Update canonical linux-raspi2 to version 4.4.0-1141.151.
- Update canonical linux-snapdragon to version 4.4.0-1145.155.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws |
< 4.4.0-1081.85 Fix: upgrade to 4.4.0-1081.85
|
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial |
< 4.4.0-193.224~14.04.1 Fix: upgrade to 4.4.0-193.224~14.04.1
|
| Ubuntu:16.04:LTS | canonical | linux |
< 4.4.0-193.224 Fix: upgrade to 4.4.0-193.224
|
| Ubuntu:16.04:LTS | canonical | linux-aws |
< 4.4.0-1117.131 Fix: upgrade to 4.4.0-1117.131
|
| Ubuntu:16.04:LTS | canonical | linux-kvm |
< 4.4.0-1082.91 Fix: upgrade to 4.4.0-1082.91
|
| Ubuntu:16.04:LTS | canonical | linux-raspi2 |
< 4.4.0-1141.151 Fix: upgrade to 4.4.0-1141.151
|
| Ubuntu:16.04:LTS | canonical | linux-snapdragon |
< 4.4.0-1145.155 Fix: upgrade to 4.4.0-1145.155
|
Original advisory text
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
Hadar Manor discovered that the DCCP protocol implementation in the Linux
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)
kernel improperly handled socket reuse, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2020-16119)
Wen Xu discovered that the XFS file system in the Linux kernel did not
properly validate inode metadata in some situations. An attacker could use
this to construct a malicious XFS image that, when mounted, could cause a
denial of service (system crash). (CVE-2018-10322)
Jay Shin discovered that the ext4 file system implementation in the Linux
kernel did not properly handle directory access with broken indexing,
leading to an out-of-bounds read vulnerability. A local attacker could use
this to cause a denial of service (system crash). (CVE-2020-14314)
It was discovered that a race condition existed in the hugetlb sysctl
implementation in the Linux kernel. A privileged attacker could use this to
cause a denial of service (system crash). (CVE-2020-25285)
References
- https://ubuntu.com/security/notices/USN-4579-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2018-10322 Third Party Advisory
- https://ubuntu.com/security/CVE-2020-14314 Third Party Advisory
- https://ubuntu.com/security/CVE-2020-16119 Third Party Advisory
- https://ubuntu.com/security/CVE-2020-25285 Third Party Advisory
Timeline
Published14 Oct 2020
Updated8 Sep 2026
First seen8 Sep 2026
Sources
USN-4579-1 · OSV
Track software like this
Free during beta