Summary
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code.(CVE-2023-6270)
It was discovered that the netfilter connection tracker for netlink in the
Linux kernel did not properly perform reference counting in some error
conditions. A local attacker could possibly use this to cause a denial of
service (memory exhaustion).(CVE-2023-7192)
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_tables: disallow anonymous set with timeout flag
Anonymous sets are never used with timeout from userspace, reject this.
Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.(CVE-2024-26642)
In the Linux kernel, the following vulnerability has been
resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we
step through the buffer and after each item we check if the size_left is
greater than the minimum size we need. However, the problem is that
'bytes_left' is type ssize_t while sizeof() is type size_t. That means that
because of type promotion, the comparison is done as an unsigned and if we
have negative bytes left the loop continues instead of ending.(CVE-2024-26828)
In the Linux kernel, the following vulnerability has been
resolved: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
Fixed packages 39
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-256.290~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-256.290 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1171.186 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1169.182~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1178.193~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1163.180~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-226.238~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-226.238 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1169.182 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1178.193 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1163.180 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-189.209~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1132.143 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-189.209 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1128.138 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1065.71~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | 5.4.0-1133.140 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | 5.4.0-1132.141 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1065.73~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke | — |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gke-5.15 | — |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gkeop | 5.4.0-1095.99 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-116.126~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm | 5.4.0-1075.80 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm-5.15 | 5.15.0-1058.61~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-116.126~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-oracle | 5.4.0-1127.136 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-oracle-5.15 | 5.15.0-1063.69~20.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-116.126 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1065.71 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1064.72 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gke | 5.15.0-1062.68 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm | 5.15.0-1058.61 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-oracle | 5.15.0-1063.69 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux | 6.8.0-36.36 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-aws | 6.8.0-1010.10 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-azure | 6.8.0-1009.9 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-gcp | 6.8.0-1009.10 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-ibm | 6.8.0-1007.7 |
Vulnerabilities 5
-
Critical 9.4
cifs: fix underflow in parse_server_interfaces()
In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the …
-
High 7.8
netfilter: nf_tables: disallow anonymous set with timeout flag
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy …
-
High 7.8
netfilter: nft_set_pipapo: do not free live element
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 10…
-
High 7.0
Kernel: aoe: improper reference count leads to use-after-free vulnerability
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access thro…
-
Medium 5.5
Kernel: refcount leak in ctnetlink_create_conntrack()
A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.