Summary
It was discovered that the IPsec implementation in the Linux kernel did not
properly allocate enough memory when performing ESP transformations,
leading to a heap-based buffer overflow. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux | 4.15.0-175.184 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws | 4.15.0-1126.135 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-azure-4.15 | 4.15.0-1136.149 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-dell300x | 4.15.0-1040.45 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-kvm | 4.15.0-1112.115 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-snapdragon | 4.15.0-1125.134 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-175.184~16.04.1 |
Vulnerabilities 1
-
Unscored —CVE-2022-27666 Public exploit
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…
References
-
report
https://ubuntu.com/security/CVE-2022-27666