Summary
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)
Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did
not properly validate u32 packets content, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39192)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate SCTP data, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39193)
Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in
the Linux kernel did not properly handle state filters, leading to an out-
of-bounds read vulnerability. A privileged local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-39194)
It was discovered that a race condition existed in QXL virtual GPU driver
in the Linux kernel, leading to a use after free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-39198)
Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)
Jason Wang discovered that the virtio ring implementation in the Linux
kernel did not properly handle iov buffers in some situations. A local
attacker in a guest VM could use this to cause a denial of service (host
system crash). (CVE-2023-5158)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)
Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws-5.15 | 5.15.0-1051.56~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-azure-5.15 | 5.15.0-1053.61~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-azure-fde-5.15 | 5.15.0-1053.61~20.04.1.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-hwe-5.15 | 5.15.0-91.101~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-ibm-5.15 | 5.15.0-1044.47~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oracle-5.15 | 5.15.0-1049.55~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux | 5.15.0-91.101 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws | 5.15.0-1051.56 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-azure | 5.15.0-1053.61 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-azure-fde | 5.15.0-1053.61.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gcp | 5.15.0-1048.56 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gke | 5.15.0-1048.53 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-ibm | 5.15.0-1044.47 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-kvm | 5.15.0-1048.53 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia | 5.15.0-1042.42 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-oracle | 5.15.0-1049.55 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-raspi | 5.15.0-1044.47 |
Vulnerabilities 11
-
High 8.8CVE-2023-5178 Public exploit
Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…
-
High 7.8CVE-2023-5717 Public exploit
Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…
-
High 7.5
Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an atta…
-
Medium 6.7
Kernel: netfilter: xtables out-of-bounds read in u32_match_it()
A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyon…
-
Medium 6.5
Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.c
A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor.
-
Medium 6.1
Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…
-
Medium 5.5
Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, lea…
-
Medium 5.5
Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…
-
Medium 5.1
Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading…
-
Medium 4.6
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in …
-
Low 3.2
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…
References
-
report
https://ubuntu.com/security/CVE-2023-3773
-
report
https://ubuntu.com/security/CVE-2023-5158
-
report
https://ubuntu.com/security/CVE-2023-5178
-
report
https://ubuntu.com/security/CVE-2023-5717
-
report
https://ubuntu.com/security/CVE-2023-37453
-
report
https://ubuntu.com/security/CVE-2023-39189
-
report
https://ubuntu.com/security/CVE-2023-39192
-
report
https://ubuntu.com/security/CVE-2023-39193
-
report
https://ubuntu.com/security/CVE-2023-39194
-
report
https://ubuntu.com/security/CVE-2023-39198
-
report
https://ubuntu.com/security/CVE-2023-42754