Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel drivers may let local attacker crash system
published 4 years ago
Summary
The Intel 10GbE network driver and the virtual terminal driver in certain Linux kernel builds can be triggered by a local user to crash the system or possibly run unwanted code. This affects Linux kernels used in cloud environments such as AWS, Azure, Google Cloud, IBM Cloud, and Oracle Cloud. Install the latest kernel updates from your distribution to close the gap.
What to do
- Update canonical linux-gcp-5.4 to version 5.4.0-1087.95~18.04.1.
- Update canonical linux-ibm-5.4 to version 5.4.0-1032.36~18.04.1.
- Update canonical linux-oracle-5.4 to version 5.4.0-1082.90~18.04.1.
- Update canonical linux-aws to version 5.4.0-1084.91.
- Update canonical linux-azure to version 5.4.0-1090.95.
- Update canonical linux-bluefield to version 5.4.0-1045.50.
- Update canonical linux-gcp to version 5.4.0-1087.95.
- Update canonical linux-gke to version 5.4.0-1081.87.
- Update canonical linux-gkeop to version 5.4.0-1052.55.
- Update canonical linux-ibm to version 5.4.0-1032.36.
- Update canonical linux-kvm to version 5.4.0-1074.79.
- Update canonical linux-oracle to version 5.4.0-1082.90.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.4 |
< 5.4.0-1087.95~18.04.1 Fix: upgrade to 5.4.0-1087.95~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-ibm-5.4 |
< 5.4.0-1032.36~18.04.1 Fix: upgrade to 5.4.0-1032.36~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.4 |
< 5.4.0-1082.90~18.04.1 Fix: upgrade to 5.4.0-1082.90~18.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws |
< 5.4.0-1084.91 Fix: upgrade to 5.4.0-1084.91
|
| Ubuntu:20.04:LTS | canonical | linux-azure |
< 5.4.0-1090.95 Fix: upgrade to 5.4.0-1090.95
|
| Ubuntu:20.04:LTS | canonical | linux-bluefield |
< 5.4.0-1045.50 Fix: upgrade to 5.4.0-1045.50
|
| Ubuntu:20.04:LTS | canonical | linux-gcp |
< 5.4.0-1087.95 Fix: upgrade to 5.4.0-1087.95
|
| Ubuntu:20.04:LTS | canonical | linux-gke |
< 5.4.0-1081.87 Fix: upgrade to 5.4.0-1081.87
|
| Ubuntu:20.04:LTS | canonical | linux-gkeop |
< 5.4.0-1052.55 Fix: upgrade to 5.4.0-1052.55
|
| Ubuntu:20.04:LTS | canonical | linux-ibm |
< 5.4.0-1032.36 Fix: upgrade to 5.4.0-1032.36
|
| Ubuntu:20.04:LTS | canonical | linux-kvm |
< 5.4.0-1074.79 Fix: upgrade to 5.4.0-1074.79
|
| Ubuntu:20.04:LTS | canonical | linux-oracle |
< 5.4.0-1082.90 Fix: upgrade to 5.4.0-1082.90
|
Original advisory text
linux-aws, linux-azure, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gkeop, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities
Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe)
Ethernet driver for the Linux kernel performed insufficient control flow
management. A local attacker could possibly use this to cause a denial of
service. (CVE-2021-33061)
It was discovered that the virtual terminal driver in the Linux kernel did
not properly handle VGA console font changes, leading to an out-of-bounds
write. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2021-33656)
References
- https://ubuntu.com/security/notices/USN-5592-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2021-33061 Third Party Advisory
- https://ubuntu.com/security/CVE-2021-33656 Third Party Advisory
Timeline
Published1 Sep 2022
Updated14 Sep 2026
First seen14 Sep 2026
Sources
USN-5592-1 · OSV
Track software like this
Free during beta