Ubuntu kernel update fixes Bluetooth use-after-free flaw
Original title: USN-8968-1: Linux kernel vulnerabilities
CVE-2021-3640 can crash the system or possibly run code locally; CVE-2022-49058 is also fixed.
Ubuntu published USN-8968-1 for Linux kernel packages. A use-after-free in the Bluetooth subsystem, CVE-2021-3640, lets a local attacker cause a system crash or possibly execute arbitrary code. The update also corrects file systems infrastructure issues tracked as CVE-2022-49058. The notice says an attacker could possibly use the issues to compromise the system.
Unconfirmed: The snippet does not state affected or fixed versions or whether the flaws are exploited.
- CVE-2021-3640 is a use-after-free in the Bluetooth subsystem.
- A local attacker could crash the system or possibly execute code.
- CVE-2022-49058 is associated with file systems infrastructure.
- The notice says the issues could be used to compromise the system.
Impact: local denial of service or possible code execution
| Product | Affected |
|---|---|
| Canonical Linux kernel | — |
- 1.Install the updated Linux kernel packages from Ubuntu.
- Vendors
- Canonical
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-3640 | A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way… | 7.0 | <1% | PoC | |
| CVE-2022-49058 | Linux kernel: cifs: potential buffer overflow in handling symlinks Smatch printed a warning… | 7.8 | <1% |
From the original article
It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640) Several security issues were discovered in the Linux kernel.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.