Summary
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)
Querijn Voet discovered that a race condition existed in the io_uring
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code.(CVE-2023-3389)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly handle some error conditions, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-3390)
Mingi Cho discovered that the netfilter subsystem in the Linux kernel did
not properly validate the status of a nft chain while performing a lookup
by id, leading to a use-after-free vulnerability. An attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code.(CVE-2023-31248)
Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in
the Ubuntu Linux kernel did not properly perform permission checks in
certain situations. A local attacker could possibly use this to gain
elevated privileges.(CVE-2023-32629)
Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel
did not properly handle certain pointer data type, leading to an out-of-
bounds write vulnerability. A privileged attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-35001)
Hangyu Hua discovered that the Flower classifier implementation in the
Linux kernel contained an out-of-bounds write vulnerability. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code.(CVE-2023-35788)
Fixed packages 31
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-243.277~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-243.277 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1159.174 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1159.172~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-214.225~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws-5.4 | 5.4.0-1106.114~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-5.4 | 5.4.0-1112.118~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-5.4 | 5.4.0-1109.118~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gke-5.4 | — |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gkeop-5.4 | — |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-155.172~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-ibm-5.4 | 5.4.0-1053.58~18.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-155.172 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1106.114 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1106.113~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | 5.4.0-1112.118 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | 5.4.0-1109.118 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1106.115~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke | 5.4.0-1104.111 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke-5.15 | 5.15.0-1038.43~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gkeop | 5.4.0-1073.77 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-177.187~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm | 5.4.0-1053.58 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-177.187~20.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-177.187 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1106.113 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws-6.2 | 6.2.0-1008.8~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure | 5.15.0-1111.120 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1106.115 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gke | 5.15.0-1102.108 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm | 5.15.0-1100.103 |
Vulnerabilities 7
-
High 7.8
Out-of-bounds write in Linux kernel's ipvlan network driver
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is r…
-
High 7.8
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
-
High 7.8CVE-2023-32629 Public exploit
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks…
-
High 7.8
Use after free in io_uring in the Linux Kernel
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac5…
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
High 7.8CVE-2023-35001 Public exploit
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
-
High 7.8CVE-2023-35788 Public exploit
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an o…
References
-
report
https://ubuntu.com/security/CVE-2023-3090
-
report
https://ubuntu.com/security/CVE-2023-3389
-
report
https://ubuntu.com/security/CVE-2023-3390
-
report
https://ubuntu.com/security/CVE-2023-31248
-
report
https://ubuntu.com/security/CVE-2023-32629
-
report
https://ubuntu.com/security/CVE-2023-35001
-
report
https://ubuntu.com/security/CVE-2023-35788