Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gke-5.3Upgrade linux-image-5.6.0-1054-oemUpgrade linux-image-5.4.0-1043-oracleUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.8.0-50-generic-lpaeUpgrade linux-image-5.8.0-1028-gcpUpgrade linux-image-genericUpgrade linux-image-5.8.0-1026-oracleUpgrade linux-image-5.8.0-50-lowlatencyUpgrade linux-image-oem-osp1Upgrade linux-image-gkeopUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.8.0-1021-raspi-nolpaeUpgrade linux-image-raspiUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1045-awsUpgrade linux-image-oem-20.04bUpgrade linux-image-oemUpgrade linux-image-5.4.0-1042-gcpUpgrade linux-image-5.3.0-73-lowlatencyUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-generic-64kUpgrade linux-image-5.3.0-73-genericUpgrade linux-image-5.4.0-72-lowlatencyUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.3.0-1042-gkeUpgrade linux-image-5.8.0-1029-azureUpgrade linux-image-azureUpgrade linux-image-5.4.0-1046-azureUpgrade linux-image-lowlatencyUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1014-gkeopUpgrade linux-image-5.8.0-50-genericUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.8.0-50-generic-64kUpgrade linux-image-5.4.0-72-genericUpgrade linux-image-5.4.0-72-generic-lpaeUpgrade linux-image-gkeop-5.3Upgrade linux-image-5.3.0-1039-raspi2Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1038-kvmUpgrade linux-image-5.8.0-1021-raspiUpgrade linux-image-gke-5.4 | Apr 16, 2021 | Apr 15, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub