Summary
It was discovered that the IPsec implementation in the Linux kernel did not
properly allocate enough memory when performing ESP transformations,
leading to a heap-based buffer overflow. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gcp-4.15 | 4.15.0-1120.134 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle | 4.15.0-1091.100 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2 | 4.15.0-1107.114 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1136.149~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1126.135~16.04.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1136.149~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1120.134~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-oracle | 4.15.0-1091.100~16.04.1 |
Vulnerabilities 1
-
Unscored —CVE-2022-27666 Public exploit
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…
References
-
report
https://ubuntu.com/security/CVE-2022-27666