Ubuntu releases kernel updates to fix Xen network and Bluetooth vulnerabilities

Ubuntu has issued security updates for the Linux kernel to address two specific vulnerabilities affecting long-term support (LTS) releases. The updates target the Xen network backend driver and the Bluetooth subsystem, providing fixes for users on Ubuntu 16.04 LTS (Xenial) and 14.04 LTS (Trusty).

These patches are primarily available through Ubuntu Pro via Legacy Support add-ons for many affected packages, including AWS, KVM, and FIPS-certified kernels. Due to an unavoidable ABI change, users must recompile and reinstall any third-party kernel modules after applying these updates and rebooting their systems.

Vulnerability details and kernel impact

• Xen Network Backend (CVE-2021-28714): A flaw in the Xen network backend driver failed to adequately limit queued packets when a guest VM did not process them, allowing a guest attacker to cause a denial of service via excessive kernel memory consumption.
• Bluetooth Subsystem (CVE-2021-3640): A use-after-free vulnerability was identified in the Bluetooth subsystem, which a local attacker could exploit to trigger a system crash or potentially execute arbitrary code.
• ABI Compatibility: The kernel updates involve an ABI change, necessitating the manual recompilation of any non-standard or third-party kernel modules to ensure system stability.
• Affected Kernel Versions: Fixes are applied to various 4.4.0 series kernels, including generic, lowlatency, virtual, AWS, and FIPS-certified variants.

Why it matters

This update is critical for administrators managing legacy cloud environments (AWS/KVM) and Xen-based virtualization, as it prevents guest-to-host denial of service attacks. System engineers using Ubuntu Pro for legacy support must also manage the overhead of recompiling third-party modules due to the ABI change.