{"id":"USN-4367-2","aliases":[],"status":"published","title":"linux regression","description":"USN-4367-1 fixed vulnerabilities in the 5.4 Linux kernel. Unfortunately,\nthat update introduced a regression in overlayfs. This update corrects\nthe problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that the btrfs implementation in the Linux kernel did not\n properly detect that a block was marked dirty in some situations. An\n attacker could use this to specially craft a file system image that, when\n unmounted, could cause a denial of service (system crash). (CVE-2019-19377)\n\n It was discovered that the linux kernel did not properly validate certain\n mount options to the tmpfs virtual memory file system. A local attacker\n with the ability to specify mount options could use this to cause a denial\n of service (system crash). (CVE-2020-11565)\n\n It was discovered that the block layer in the Linux kernel contained a race\n condition leading to a use-after-free vulnerability. A local attacker could\n possibly use this to cause a denial of service (system crash) or execute\n arbitrary code. (CVE-2020-12657)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-05-28T22:46:00Z","modified":"2026-04-22T10:05:08Z","fixes":[{"ecosystem":"Ubuntu:20.04:LTS","package":"linux","fixed_in":["5.4.0-33.37"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-33.37"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-4367-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1879690","tags":["report"]}],"sources":{"osv":[{"id":"USN-4367-2","title":"linux regression","description":"USN-4367-1 fixed vulnerabilities in the 5.4 Linux kernel. Unfortunately,\nthat update introduced a regression in overlayfs. This update corrects\nthe problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that the btrfs implementation in the Linux kernel did not\n properly detect that a block was marked dirty in some situations. An\n attacker could use this to specially craft a file system image that, when\n unmounted, could cause a denial of service (system crash). (CVE-2019-19377)\n\n It was discovered that the linux kernel did not properly validate certain\n mount options to the tmpfs virtual memory file system. A local attacker\n with the ability to specify mount options could use this to cause a denial\n of service (system crash). (CVE-2020-11565)\n\n It was discovered that the block layer in the Linux kernel contained a race\n condition leading to a use-after-free vulnerability. A local attacker could\n possibly use this to cause a denial of service (system crash) or execute\n arbitrary code. (CVE-2020-12657)\n","status":"published","published":"2020-05-28T22:46:00Z","modified":"2026-04-22T10:05:08.795791Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}