Summary
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel contained a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-1281)
It was discovered that the OverlayFS implementation in the Linux kernel did
not properly handle copy up operation in some conditions. A local attacker
could possibly use this to gain elevated privileges. (CVE-2023-0386)
Haowei Yan discovered that a race condition existed in the Layer 2
Tunneling Protocol (L2TP) implementation in the Linux kernel. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2022-4129)
It was discovered that the network queuing discipline implementation in the
Linux kernel contained a null pointer dereference in some situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2022-47929)
It was discovered that the NTFS file system implementation in the Linux
kernel contained a null pointer dereference in some situations. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2022-4842)
Kyle Zeng discovered that the IPv6 implementation in the Linux kernel
contained a NULL pointer dereference vulnerability in certain situations. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2023-0394)
It was discovered that the Human Interface Device (HID) support driver in
the Linux kernel contained a type confusion vulnerability in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1073)
It was discovered that a memory leak existed in the SCTP protocol
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (memory exhaustion). (CVE-2023-1074)
It was discovered that the NFS implementation in the Linux kernel did not
properly handle pending tasks in some situations. A local attacker could
use this to cause a denial of service (system crash) or expose sensitive
information (kernel memory). (CVE-2023-1652)
Lianhui Tang discovered that the MPLS implementation in the Linux kernel
did not properly handle certain sysctl allocation failure conditions,
leading to a double-free vulnerability. An attacker could use this to cause
a denial of service or possibly execute arbitrary code. (CVE-2023-26545)
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws-5.15 | 5.15.0-1034.38~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-azure-5.15 | 5.15.0-1036.43~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp-5.15 | 5.15.0-1032.40~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gke-5.15 | 5.15.0-1031.36~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-70.77~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oracle-5.15 | 5.15.0-1033.39~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux | 5.15.0-70.77 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws | 5.15.0-1034.38 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-azure | 5.15.0-1036.43 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-azure-fde | 5.15.0-1036.43.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gcp | 5.15.0-1032.40 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gke | 5.15.0-1031.36 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gkeop | 5.15.0-1018.23 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-ibm | 5.15.0-1028.31 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-kvm | 5.15.0-1031.36 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-lowlatency | 5.15.0-70.77 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-oracle | 5.15.0-1033.39 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-raspi | 5.15.0-1027.29 |
Vulnerabilities 10
-
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.1
A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel.…
-
Medium 6.6
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…
-
Medium 5.5
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can…
-
Medium 5.5
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivilege…
-
Medium 5.5
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user cou…
-
Medium 5.5
A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in…
-
Medium 5.5
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a us…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
References
-
report
https://ubuntu.com/security/CVE-2022-4129
-
report
https://ubuntu.com/security/CVE-2022-4842
-
report
https://ubuntu.com/security/CVE-2022-47929
-
report
https://ubuntu.com/security/CVE-2023-0386
-
report
https://ubuntu.com/security/CVE-2023-0394
-
report
https://ubuntu.com/security/CVE-2023-1073
-
report
https://ubuntu.com/security/CVE-2023-1074
-
report
https://ubuntu.com/security/CVE-2023-1281
-
report
https://ubuntu.com/security/CVE-2023-1652
-
report
https://ubuntu.com/security/CVE-2023-26545