Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.

An update of the linux package has been released.

The remote host is affected by the vulnerability described in GLSA-202107-30 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5050-1 advisory.

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access     control. An authenticated attacker could possibly use this to expose sensitive information.
    (CVE-2020-26558, CVE-2021-0129)

    Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed     packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-38208)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5046-1 advisory.

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access     control. An authenticated attacker could possibly use this to expose sensitive information.
    (CVE-2020-26558, CVE-2021-0129)

    Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed     packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-3587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5015-1 advisory.

    It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to     signed integer conversion error. A local attacker could use this to cause a denial of service (system     crash) or execute arbitrary code. (CVE-2021-33909)

    Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed     packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM     could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-3564)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device     detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2021-3573)

    It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect     events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of     service. (CVE-2021-3587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202866	Photon OS 4.0: Linux PHSA-2021-4.0-0058	Nessus	PhotonOS Local Security Checks	high
160459	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	high
157004	GLSA-202107-30 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
152774	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5050-1)	Nessus	Ubuntu Local Security Checks	high
152665	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5046-1)	Nessus	Ubuntu Local Security Checks	high
151921	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5015-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-28691

high

Tenable Plugins

high

high

high

high

high

high