Summary
Pratyush Yadav discovered that the Xen network backend implementation in
the Linux kernel did not properly handle zero length data request, leading
to a null pointer dereference vulnerability. An attacker in a guest VM
could possibly use this to cause a denial of service (host domain crash).
(CVE-2023-46838)
It was discovered that the IPv6 implementation of the Linux kernel did not
properly manage route cache memory usage. A remote attacker could use this
to cause a denial of service (memory exhaustion). (CVE-2023-52340)
It was discovered that the device mapper driver in the Linux kernel did not
properly validate target size during certain memory allocations. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-52429, CVE-2024-23851)
Dan Carpenter discovered that the netfilter subsystem in the Linux kernel
did not store data in properly sized memory locations. A local user could
use this to cause a denial of service (system crash). (CVE-2024-0607)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Architecture specifics;
- Cryptographic API;
- Android drivers;
- EDAC drivers;
- GPU drivers;
- Media drivers;
- MTD block device drivers;
- Network drivers;
- NVME drivers;
- TTY drivers;
- Userspace I/O drivers;
- F2FS file system;
- GFS2 file system;
- IPv6 Networking;
- AppArmor security module;
(CVE-2023-52464, CVE-2023-52448, CVE-2023-52457, CVE-2023-52443,
CVE-2023-52439, CVE-2023-52612, CVE-2024-26633, CVE-2024-26597,
CVE-2023-52449, CVE-2023-52444, CVE-2023-52609, CVE-2023-52469,
CVE-2023-52445, CVE-2023-52451, CVE-2023-52470, CVE-2023-52454,
CVE-2023-52436, CVE-2023-52438)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-iot | 5.4.0-1034.35 |
Vulnerabilities 23
-
High 7.8
f2fs: explicitly null-terminate the xattr list
In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always ze…
-
High 7.8
binder: fix use-after-free in shinker's callback
In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). …
-
High 7.8
uio: Fix use-after-free in uio_open
In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_de…
-
High 7.8
f2fs: fix to avoid dirent corruption
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2f…
-
High 7.8
drivers/amd/pm: fix a use-after-free in kv_parse_power_table
In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the …
-
High 7.8
crypto: scomp - fix req->dst buffer overflow
In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.
-
High 7.8
net: qualcomm: rmnet: fix global oob in rmnet_policy
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See …
-
High 7.5
Linux: netback processing of zero-length transmit fragment
Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred da…
-
High 7.5
The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed e…
-
High 7.5
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec(). Unable…
-
Medium 6.6
Kernel: nf_tables: pointer math issue in nft_byteorder_eval()
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so …
-
Medium 5.5
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate m…
-
Medium 5.5
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes,…
-
Medium 5.5
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough…
-
Unscored —
apparmor: avoid crash when parsed profile name is empty
In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd …
-
Unscored —
media: pvrusb2: fix use after free on context disconnection
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thu…
-
Unscored —
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…
-
Unscored —
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->d…
-
Unscored —
powerpc/pseries/memhp: Fix access beyond end of drmem array
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with…
-
Unscored —
serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed Returning an error code from .remove() makes the driver core emit the little helpful error message: remov…
-
Unscored —
EDAC/thunderx: Fix possible out-of-bounds string access
In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In fu…
-
Unscored —
drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref.
-
Unscored —
binder: fix race between mmput() and do_exit()
In the Linux kernel, the following vulnerability has been resolved: binder: fix race between mmput() and do_exit() Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm …
References
-
report
https://ubuntu.com/security/CVE-2023-46838
-
report
https://ubuntu.com/security/CVE-2023-52340
-
report
https://ubuntu.com/security/CVE-2023-52429
-
report
https://ubuntu.com/security/CVE-2023-52436
-
report
https://ubuntu.com/security/CVE-2023-52438
-
report
https://ubuntu.com/security/CVE-2023-52439
-
report
https://ubuntu.com/security/CVE-2023-52443
-
report
https://ubuntu.com/security/CVE-2023-52444
-
report
https://ubuntu.com/security/CVE-2023-52445
-
report
https://ubuntu.com/security/CVE-2023-52448
-
report
https://ubuntu.com/security/CVE-2023-52449
-
report
https://ubuntu.com/security/CVE-2023-52451
-
report
https://ubuntu.com/security/CVE-2023-52454
-
report
https://ubuntu.com/security/CVE-2023-52457
-
report
https://ubuntu.com/security/CVE-2023-52464
-
report
https://ubuntu.com/security/CVE-2023-52469
-
report
https://ubuntu.com/security/CVE-2023-52470
-
report
https://ubuntu.com/security/CVE-2023-52609
-
report
https://ubuntu.com/security/CVE-2023-52612
-
report
https://ubuntu.com/security/CVE-2024-0607
-
report
https://ubuntu.com/security/CVE-2024-23851
-
report
https://ubuntu.com/security/CVE-2024-26597
-
report
https://ubuntu.com/security/CVE-2024-26633