Summary
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)
It was discovered that the virtual terminal driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly expose sensitive
information (kernel memory).(CVE-2023-3567)
It was discovered that the universal 32bit network packet classifier
implementation in the Linux kernel did not properly perform reference
counting in some situations, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code.(CVE-2023-3609)
It was discovered that the network packet classifier with
netfilter/firewall marks implementation in the Linux kernel did not
properly handle reference counting, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-3776)
Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly handle table rules flush in certain circumstances. A local
attacker could possibly use this to cause a denial of service (system
crash) or execute arbitrary code.(CVE-2023-3777)
Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly handle rule additions to bound chains in certain
circumstances. A local attacker could possibly use this to cause a denial
of service (system crash) or execute arbitrary code.(CVE-2023-3995)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly handle PIPAPO element removal, leading to a use-after-free
vulnerability. A local attacker could possibly use this to cause a denial
of service (system crash) or execute arbitrary code.(CVE-2023-4004)
It was discovered that some network classifier implementations in the Linux
kernel contained use-after-free vulnerabilities. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code.(CVE-2023-4128)
Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux
kernel did not properly handle locking for rings with IOPOLL, leading to a
double-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-21400)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle L2CAP socket release, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-40283)
Fixed packages 31
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-245.279~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-245.279 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1161.176 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1170.185~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1155.172~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-218.229 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1161.174 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1170.185 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1155.172 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-205.225 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1139.149 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1045.50~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | 5.4.0-1143.150 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | 5.4.0-1142.151 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1042.50~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke | 5.4.0-1104.111 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke-5.15 | 5.15.0-1038.43~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gkeop | 5.4.0-1077.81 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-84.93~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm | 5.4.0-1085.90 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-84.93~20.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-84.93 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1045.50 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws-6.2 | 6.2.0-1012.12~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure | 5.15.0-1047.54 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure-6.2 | 6.2.0-1012.12~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1042.50 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp-6.2 | 6.2.0-1014.14~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gke | 5.15.0-1042.47 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-hwe-6.2 | 6.2.0-33.33~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm | 5.15.0-1038.41 |
Vulnerabilities 10
-
High 7.8
Out-of-bounds write in Linux kernel's ipvlan network driver
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is r…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8CVE-2023-3776 Public exploit
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the refere…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner ru…
-
High 7.8
Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pr…
-
High 7.8
An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…
-
High 7.1
Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
-
Unscored —
In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could l…
-
Unscored —CVE-2023-3995 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is a duplicate of CVE-2023-4147.
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…
References
-
report
https://ubuntu.com/security/CVE-2023-3090
-
report
https://ubuntu.com/security/CVE-2023-3567
-
report
https://ubuntu.com/security/CVE-2023-3609
-
report
https://ubuntu.com/security/CVE-2023-3776
-
report
https://ubuntu.com/security/CVE-2023-3777
-
report
https://ubuntu.com/security/CVE-2023-3995
-
report
https://ubuntu.com/security/CVE-2023-4004
-
report
https://ubuntu.com/security/CVE-2023-4128
-
report
https://ubuntu.com/security/CVE-2023-21400
-
report
https://ubuntu.com/security/CVE-2023-40283