Summary
Wei Chen discovered that a race condition existed in the TIPC protocol
implementation in the Linux kernel, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1382)
It was discovered that the virtio network implementation in the Linux
kernel did not properly handle file references in the host, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly expose sensitive information
(kernel memory). (CVE-2023-1838)
Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2
mitigations with prctl syscall were insufficient in some situations. A
local attacker could possibly use this to expose sensitive information.
(CVE-2023-1998)
Daniele Antonioli discovered that the Secure Simple Pairing and Secure
Connections pairing in the Bluetooth protocol could allow an
unauthenticated user to complete authentication without pairing
credentials. A physically proximate attacker placed between two Bluetooth
devices could use this to subsequently impersonate one of the paired
devices. (CVE-2023-24023)
shanzhulig discovered that the DRM subsystem in the Linux kernel contained
a race condition when performing certain operation while handling driver
unload, leading to a use-after-free vulnerability. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2023-51043)
It was discovered that a race condition existed in the Bluetooth subsystem
of the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-51779)
It was discovered that the device mapper driver in the Linux kernel did not
properly validate target size during certain memory allocations. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-52429, CVE-2024-23851)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
It was discovered that the SCTP protocol implementation in the Linux kernel
contained a race condition when handling lock acquisition in certain
situations. A local attacker could possibly use this to cause a denial of
service (kernel deadlock). (CVE-2024-0639)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Architecture specifics;
- EDAC drivers;
- Media drivers;
- JFS file system;
(CVE-2023-52603, CVE-2023-52464, CVE-2023-52600, CVE-2023-52445,
CVE-2023-52451)
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1176.191~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1167.180~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1176.191~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1161.178~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-224.236~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-oracle | 4.15.0-1130.141~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-224.236 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1167.180 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1176.191 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1161.178 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-kvm | 4.15.0-1151.156 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1130.141 |
Vulnerabilities 15
-
High 7.8
jfs: fix uaf in jfs_evict_inode
In the Linux kernel, the following vulnerability has been resolved: jfs: fix uaf in jfs_evict_inode When the execution of diMount(ipimap) fails, the object ipimap that has been released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs wh…
-
High 7.8
UBSAN: array-index-out-of-bounds in dtSplitRoot
In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1…
-
High 7.0
In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a n…
-
High 7.0
bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_…
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 6.2
Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate m…
-
Medium 5.5
Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
-
Medium 5.5
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes,…
-
Medium 4.7
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…
-
Unscored —
A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…
-
Unscored —
media: pvrusb2: fix use after free on context disconnection
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thu…
-
Unscored —
powerpc/pseries/memhp: Fix access beyond end of drmem array
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with…
-
Unscored —
EDAC/thunderx: Fix possible out-of-bounds string access
In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In fu…
References
-
report
https://ubuntu.com/security/CVE-2023-1382
-
report
https://ubuntu.com/security/CVE-2023-1838
-
report
https://ubuntu.com/security/CVE-2023-1998
-
report
https://ubuntu.com/security/CVE-2023-6915
-
report
https://ubuntu.com/security/CVE-2023-24023
-
report
https://ubuntu.com/security/CVE-2023-51043
-
report
https://ubuntu.com/security/CVE-2023-51779
-
report
https://ubuntu.com/security/CVE-2023-52429
-
report
https://ubuntu.com/security/CVE-2023-52445
-
report
https://ubuntu.com/security/CVE-2023-52451
-
report
https://ubuntu.com/security/CVE-2023-52464
-
report
https://ubuntu.com/security/CVE-2023-52600
-
report
https://ubuntu.com/security/CVE-2023-52603
-
report
https://ubuntu.com/security/CVE-2024-0639
-
report
https://ubuntu.com/security/CVE-2024-23851