Summary
It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux
kernel did not properly perform bounds checking in some situations. A
physically proximate attacker could use this to craft a malicious USB
device that when inserted, could cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-3628)
It was discovered that a use-after-free vulnerability existed in the
Bluetooth stack in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3640)
Khalid Masum discovered that the NILFS2 file system implementation in the
Linux kernel did not properly handle certain error conditions, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service or possibly execute arbitrary code. (CVE-2022-3649)
It was discovered that a race condition existed in the SMSC UFX USB driver
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A physically proximate attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2022-41849)
It was discovered that a race condition existed in the Roccat HID driver in
the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2022-41850)
Tamás Koczka discovered that the Bluetooth L2CAP implementation in the
Linux kernel did not properly initialize memory in some situations. A
physically proximate attacker could possibly use this to expose sensitive
information (kernel memory). (CVE-2022-42895)
It was discovered that the binder IPC implementation in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-20928)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux-aws-5.4 | 5.4.0-1096.104~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-gcp-5.4 | 5.4.0-1100.109~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-hwe-5.4 | 5.4.0-139.156~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-ibm-5.4 | 5.4.0-1044.49~18.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oracle-5.4 | 5.4.0-1093.102~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp | 5.4.0-1100.109 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-ibm | 5.4.0-1044.49 |
Vulnerabilities 7
-
High 7.8
In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local e…
-
Medium 6.6
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user conn…
-
Medium 5.5
Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a pat…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Low 3.1
Linux Kernel BPF inode.c nilfs_new_inode use after free
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remote…
-
Unscored —
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if …
-
Unscored —
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant …
References
-
report
https://ubuntu.com/security/CVE-2022-3628
-
report
https://ubuntu.com/security/CVE-2022-3640
-
report
https://ubuntu.com/security/CVE-2022-3649
-
report
https://ubuntu.com/security/CVE-2022-41849
-
report
https://ubuntu.com/security/CVE-2022-41850
-
report
https://ubuntu.com/security/CVE-2022-42895
-
report
https://ubuntu.com/security/CVE-2023-20928