Ubuntu kernel update fixes Xen netback DoS and Bluetooth flaw
Original title: USN-8966-1: Linux kernel vulnerabilities
A guest can exhaust backend memory, and a local user may crash the system or possibly run code.
Ubuntu USN-8966-1 covers two Linux kernel issues. Jürgen Groß found that the Xen network backend did not limit queued packets when a guest failed to process them, letting a guest attacker cause a denial of service through excessive kernel memory use (CVE-2021-28714). A Bluetooth use-after-free lets a local attacker crash the system or possibly execute arbitrary code (CVE-2021-3640).
Unconfirmed: The notice does not say whether either flaw is exploited.
- CVE-2021-28714 affects the Xen network backend driver.
- The guest attack consumes kernel memory in the backend domain.
- CVE-2021-3640 is a local Bluetooth use-after-free.
- Fixed package versions are not stated in the snippet.
Impact: guest memory exhaustion or local code execution
| Product | Affected |
|---|---|
| Ubuntu Linux kernel | — |
- 1.Install the Linux kernel update from USN-8966-1.
- Vendors
- Ubuntu
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-28714 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs | 6.5 | <1% | ||
| CVE-2021-3640 | A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way… | 7.0 | <1% | PoC |
From the original article
Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memory consumption) in the network backend domain.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.