Debian LTS 9: DLA-2785-1 Critical: Linux Kernel Privilege Escalation

A flaw was found in the driver for Atheros IEEE 802.11n family of
chipsets (ath9k) allowing information disclosure.

CVE-2020-16119

Hadar Manor reported a use-after-free in the DCCP protocol
implementation in the Linux kernel. A local attacker can take
advantage of this flaw to cause a denial of service or potentially
to execute arbitrary code.

CVE-2021-3444, CVE-2021-3600

Two flaws were discovered in the Extended BPF (eBPF) verifier. A
local user could exploit these to read and write arbitrary memory
in the kernel, which could be used for privilege escalation.

This can be mitigated by setting sysctl
kernel.unprivileged_bpf_disabled=1, which disables eBPF use by
unprivileged users.

CVE-2021-3612

Murray McAllister reported a flaw in the joystick input subsystem.
A local user permitted to access a joystick device could exploit
this to read and write out-of-bounds in the kernel, which could
be used for privilege escalation.

CVE-2021-3653