All Vulnerability Reports

USN-5003-1: Linux kernel vulnerabilities


Severity

High

Vendor

VMware Tanzu

Versions Affected

  • Canonical Ubuntu 16.04

Description

Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute arbitrary code. (CVE-2021-3609)

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code. (CVE-2021-3600)

Or Cohen discovered that the SCTP implementation in the Linux kernel contained a race condition in some situations, leading to a use-after-free condition. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-23133)

CVEs contained in this USN include: CVE-2021-3609, CVE-2021-23133, CVE-2021-3600

Affected VMware Products and Versions

Severity is high unless otherwise noted.

  • Isolation Segment
    • 2.7.x versions with Xenial Stemcells prior to 456.166
    • 2.8.x versions with Xenial Stemcells prior to 621.131
    • 2.9.x versions with Xenial Stemcells prior to 621.131
    • 2.10.x versions with Xenial Stemcells prior to 621.131
    • 2.11.x versions with Xenial Stemcells prior to 621.131
  • Operations Manager
    • 2.9.x versions prior to 2.9.21
    • 2.10.x versions prior to 2.10.15
  • VMware Tanzu Application Service for VMs
    • 2.7.x versions with Xenial Stemcells prior to 456.166
    • 2.8.x versions with Xenial Stemcells prior to 621.131
    • 2.9.x versions with Xenial Stemcells prior to 621.131
    • 2.10.x versions with Xenial Stemcells prior to 621.131
    • 2.11.x versions with Xenial Stemcells prior to 621.131
    • 2.12.x versions with Xenial Stemcells prior to 621.131

Mitigation

Users of affected products are strongly encouraged to follow the mitigation below. On the Tanzu Network product page for each release, check the Depends On section and/or Release Notes for this information. Releases that have fixed this issue include:

  • Isolation Segment
    • 2.7.x: Upgrade Xenial Stemcells to 456.166 or greater
    • 2.8.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.9.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.10.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.11.x: Upgrade Xenial Stemcells to 621.131 or greater
  • Operations Manager
    • 2.9.21
    • 2.10.15
  • VMware Tanzu Application Service for VMs
    • 2.7.x: Upgrade Xenial Stemcells to 456.166 or greater
    • 2.8.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.9.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.10.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.11.x: Upgrade Xenial Stemcells to 621.131 or greater
    • 2.12.x: Upgrade Xenial Stemcells to 621.131 or greater

References

History

2021-12-08: Initial vulnerability report published.