Summary
It was discovered that a race condition existed in the instruction emulator
of the Linux kernel on Arm 64-bit systems. A local attacker could use this
to cause a denial of service (system crash). (CVE-2022-20422)
Wei Chen discovered that a race condition existed in the TIPC protocol
implementation in the Linux kernel, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1382)
Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2
mitigations with prctl syscall were insufficient in some situations. A
local attacker could possibly use this to expose sensitive information.
(CVE-2023-1998)
Daniele Antonioli discovered that the Secure Simple Pairing and Secure
Connections pairing in the Bluetooth protocol could allow an
unauthenticated user to complete authentication without pairing
credentials. A physically proximate attacker placed between two Bluetooth
devices could use this to subsequently impersonate one of the paired
devices. (CVE-2023-24023)
shanzhulig discovered that the DRM subsystem in the Linux kernel contained
a race condition when performing certain operation while handling driver
unload, leading to a use-after-free vulnerability. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2023-51043)
It was discovered that a race condition existed in the Bluetooth subsystem
of the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-51779)
It was discovered that the device mapper driver in the Linux kernel did not
properly validate target size during certain memory allocations. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-52429, CVE-2024-23851)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Architecture specifics;
- ACPI drivers;
- I2C subsystem;
- Media drivers;
- JFS file system;
- IPv4 Networking;
- Open vSwitch;
(CVE-2021-46966, CVE-2021-46936, CVE-2023-52451, CVE-2019-25162,
CVE-2023-52445, CVE-2023-52600, CVE-2021-46990, CVE-2021-46955,
CVE-2023-52603)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-aws | 4.4.0-1130.136 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-253.287~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-253.287 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1168.183 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-kvm | 4.4.0-1131.141 |
Vulnerabilities 17
-
High 8.2
openvswitch: fix stack OOB read while fragmenting IPv4 packets
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 pa…
-
High 7.8CVE-2019-25162 Public exploit
i2c: Fix a potential use after free
In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment…
-
High 7.8
net: fix use-after-free in tw_timer_handler
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe6…
-
High 7.8
jfs: fix uaf in jfs_evict_inode
In the Linux kernel, the following vulnerability has been resolved: jfs: fix uaf in jfs_evict_inode When the execution of diMount(ipimap) fails, the object ipimap that has been released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs wh…
-
High 7.8
UBSAN: array-index-out-of-bounds in dtSplitRoot
In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1…
-
High 7.0
In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a n…
-
High 7.0
bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_…
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate m…
-
Medium 5.5
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes,…
-
Medium 4.7
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…
-
Unscored —
ACPI: custom_method: fix potential use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: ACPI: custom_method: fix potential use-after-free issue In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocat…
-
Unscored —
powerpc/64s: Fix crashes when toggling entry flush barrier
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix crashes when toggling entry flush barrier The entry flush mitigation can be enabled/disabled at runtime via a debugfs file (entry_flush), which causes the kernel to patch its…
-
Unscored —
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. Thi…
-
Unscored —
media: pvrusb2: fix use after free on context disconnection
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thu…
-
Unscored —
powerpc/pseries/memhp: Fix access beyond end of drmem array
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with…
References
-
report
https://ubuntu.com/security/CVE-2019-25162
-
report
https://ubuntu.com/security/CVE-2021-46936
-
report
https://ubuntu.com/security/CVE-2021-46955
-
report
https://ubuntu.com/security/CVE-2021-46966
-
report
https://ubuntu.com/security/CVE-2021-46990
-
report
https://ubuntu.com/security/CVE-2022-20422
-
report
https://ubuntu.com/security/CVE-2023-1382
-
report
https://ubuntu.com/security/CVE-2023-1998
-
report
https://ubuntu.com/security/CVE-2023-24023
-
report
https://ubuntu.com/security/CVE-2023-51043
-
report
https://ubuntu.com/security/CVE-2023-51779
-
report
https://ubuntu.com/security/CVE-2023-52429
-
report
https://ubuntu.com/security/CVE-2023-52445
-
report
https://ubuntu.com/security/CVE-2023-52451
-
report
https://ubuntu.com/security/CVE-2023-52600
-
report
https://ubuntu.com/security/CVE-2023-52603
-
report
https://ubuntu.com/security/CVE-2024-23851