Ubuntu USN-4577-1: Linux Kernel DCCP UAF (CVE-2020-16119) and OverlayFS Privilege Bypass (CVE-2020-16120) Fix

Key Information Announcement ID: USN-4577-1 Title: Linux kernel vulnerabilities Release Date: 14 October 2020 Summary: Multiple security issues in the Linux kernel have been fixed. Version: 18.04 LTS Packages - Linux kernel for Google Container Engine (GKE) systems - Linux kernel for Google Container Engine (GKE) systems - Linux hardware enablement (HWE) kernel - Linux kernel for OEM systems - Linux kernel for Raspberry Pi (V8) systems Details Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handles socket reuse, leading to a use-after-free vulnerability. A local attacker could exploit this to cause a denial of service (system crash) or potentially execute arbitrary code. (CVE-2020-16119) Giuseppe Scrivano discovered that the overlay filesystem in the Linux kernel does not properly enforce permission checks in certain cases. A local attacker could exploit this to bypass intended restrictions and gain read access to restricted files. (CVE-2020-16120) Update Instructions A system reboot is required after standard system updates to apply all necessary changes. Note: Due to unavoidable ABI changes, the kernel update has received a new version number, requiring recompilation and reinstallation of all third-party kernel modules. Upgrading to the following package versions resolves the issue. References CVE-2020-16120 CVE-2020-16119 Related Announcements USN-4580-1 USN-4579-1 USN-4578-1 USN-4576-1 LSN-0072-1

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-4577-1: Linux Kernel DCCP UAF (CVE-2020-16119) and OverlayFS Privilege Bypass (CVE-2020-16120) Fix