Summary
It was discovered that the Xen netback driver in the Linux kernel did not
properly handle packets structured in certain ways. An attacker in a guest
VM could possibly use this to cause a denial of service (host NIC
availability).(CVE-2022-3643)
It was discovered that the virtual terminal driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly expose sensitive
information (kernel memory).(CVE-2023-3567)
It was discovered that the universal 32bit network packet classifier
implementation in the Linux kernel did not properly perform reference
counting in some situations, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code.(CVE-2023-3609)
It was discovered that the network packet classifier with
netfilter/firewall marks implementation in the Linux kernel did not
properly handle reference counting, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-3776)
Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly handle table rules flush in certain circumstances. A local
attacker could possibly use this to cause a denial of service (system
crash) or execute arbitrary code.(CVE-2023-3777)
Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly handle rule additions to bound chains in certain
circumstances. A local attacker could possibly use this to cause a denial
of service (system crash) or execute arbitrary code.(CVE-2023-3995)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly handle PIPAPO element removal, leading to a use-after-free
vulnerability. A local attacker could possibly use this to cause a denial
of service (system crash) or execute arbitrary code.(CVE-2023-4004)
Bing-Jhong Billy Jheng discovered that the Unix domain socket
implementation in the Linux kernel contained a race condition in certain
situations, leading to a use-after-free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code.(CVE-2023-4622)
Budimir Markovic discovered that the qdisc implementation in the Linux
kernel did not properly validate inner classes, leading to a use-after-free
vulnerability. A local user could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-4623)
Alex Birnberg discovered that the netfilter subsystem in the Linux kernel
did not properly validate register length, leading to an out-of- bounds
write vulnerability. A local attacker could possibly use this to cause a
denial of service (system crash).(CVE-2023-4881)
Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly handle removal of rules from chain bindings in certain
circumstances, leading to a use-after-free vulnerability. A local attacker
could possibly use this to cause a denial of service (system crash) or
execute arbitrary code.(CVE-2023-5197)
Gwangun Jung discovered that the Quick Fair Queueing scheduler
implementation in the Linux kernel contained an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-31436)
Ross Lagerwall discovered that the Xen netback backend driver in the Linux
kernel did not properly handle certain unusual packets from a
paravirtualized network frontend, leading to a buffer overflow. An attacker
in a guest VM could use this to cause a denial of service (host system
crash) or possibly execute arbitrary code.(CVE-2023-34319)
It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle L2CAP socket release, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-40283)
Kyle Zeng discovered that the networking stack implementation in the Linux
kernel did not properly validate skb object size in certain conditions. An
attacker could use this cause a denial of service (system crash) or
possibly execute arbitrary code.(CVE-2023-42752)
Kyle Zeng discovered that the netfiler subsystem in the Linux kernel did
not properly calculate array offsets, leading to a out-of-bounds write
vulnerability. A local user could use this to cause a denial of service
(system crash) or possibly execute arbitrary code.(CVE-2023-42753)
Fixed packages 39
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-246.280~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-246.280 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1162.177 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1162.175~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1171.186~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1156.173~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-219.230~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-219.230 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1162.175 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws-5.4 | 5.4.0-1112.121~18.04.2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1171.186 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-5.4 | 5.4.0-1118.125~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1156.173 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-5.4 | 5.4.0-1116.125~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-165.182~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-ibm-5.4 | 5.4.0-1059.64~18.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-165.182 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1112.121 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1048.53~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | 5.4.0-1118.125 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | 5.4.0-1116.125 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1045.53~20.04.2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke | 5.4.0-1100.107 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke-5.15 | 5.15.0-1034.39~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gkeop | 5.4.0-1079.83 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-87.97~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm | 5.4.0-1059.64 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm-5.15 | 5.15.0-1041.44~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-87.96~20.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-87.97 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1048.53 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws-6.2 | 6.2.0-1014.14~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure | 5.15.0-1050.57 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure-6.2 | 6.2.0-1015.15~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1045.53 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp-6.2 | 6.2.0-1017.19~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gke | 5.15.0-1045.50 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-hwe-6.2 | 6.2.0-35.35~22.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm | 5.15.0-1041.44 |
Vulnerabilities 16
-
High 7.8
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…
-
High 7.8
Linux: buffer overrun in netback due to unusual packet
The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8CVE-2023-3776 Public exploit
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the refere…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner ru…
-
High 7.8
Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pr…
-
High 7.8
An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…
-
High 7.8CVE-2023-4622 Public exploit
Use-after-free in Linux kernel's af_unix component
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…
-
High 7.8
Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component
A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recomm…
-
High 7.1
Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
-
High 7.0
Kernel: netfilter: potential slab-out-of-bound access due to integer underflow
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer o…
-
Medium 5.5
Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.
-
Unscored —
Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface re…
-
Unscored —CVE-2023-3995 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is a duplicate of CVE-2023-4147.
-
Unscored —CVE-2023-4881 Rejected
CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security tea…
References
-
report
https://ubuntu.com/security/CVE-2022-3643
-
report
https://ubuntu.com/security/CVE-2023-3567
-
report
https://ubuntu.com/security/CVE-2023-3609
-
report
https://ubuntu.com/security/CVE-2023-3776
-
report
https://ubuntu.com/security/CVE-2023-3777
-
report
https://ubuntu.com/security/CVE-2023-3995
-
report
https://ubuntu.com/security/CVE-2023-4004
-
report
https://ubuntu.com/security/CVE-2023-4622
-
report
https://ubuntu.com/security/CVE-2023-4623
-
report
https://ubuntu.com/security/CVE-2023-4881
-
report
https://ubuntu.com/security/CVE-2023-5197
-
report
https://ubuntu.com/security/CVE-2023-31436
-
report
https://ubuntu.com/security/CVE-2023-34319
-
report
https://ubuntu.com/security/CVE-2023-40283
-
report
https://ubuntu.com/security/CVE-2023-42752
-
report
https://ubuntu.com/security/CVE-2023-42753