Summary
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida
discovered that the Linux kernel mitigations for the initial Branch History
Injection vulnerability (CVE-2022-0001) were insufficient for Intel
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2024-2201)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Hardware random number generator core;
- Ext4 file system;
- JFS file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- Logical Link layer;
- Netlink;
- Tomoyo security module;
(CVE-2024-26704, CVE-2023-52615, CVE-2024-26805, CVE-2023-52604,
CVE-2024-26614, CVE-2023-52602, CVE-2024-26635, CVE-2024-26622,
CVE-2023-52601, CVE-2024-26801)
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws-6.5 | 6.5.0-1020.20~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-azure-6.5 | 6.5.0-1021.22~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gcp-6.5 | 6.5.0-1020.20~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-hwe-6.5 | 6.5.0-35.35~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-35.35.1~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia-6.5 | 6.5.0-1019.19 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-oem-6.5 | 6.5.0-1023.24 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-oracle-6.5 | 6.5.0-1023.23~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-starfive-6.5 | 6.5.0-1014.15~22.04.1 |
Vulnerabilities 12
-
High 8.8
Bluetooth: Avoid potential use-after-free in hci_error_reset
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would …
-
High 7.8
jfs: fix array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbAdjTree Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which …
-
High 7.8
jfs: fix slab-out-of-bounds Read in dtSearch
In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the er…
-
High 7.8
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type …
-
High 7.8
tcp: make sure init the accept_queue's spinlocks once
In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value …
-
High 7.8
ext4: fix double-free of blocks due to wrong extents moved_len
In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and don…
-
Medium 4.7
CVE-2024-2201
A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.
-
Medium 4.3
The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unp…
-
Unscored —
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /de…
-
Unscored —
tomoyo: fix UAF write bug in tomoyo_write_control()
In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->…
-
Unscored —
llc: Drop support for ETH_P_TR_802_2.
In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latte…
-
Unscored —
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` …
References
-
report
https://ubuntu.com/security/CVE-2023-47233
-
report
https://ubuntu.com/security/CVE-2023-52601
-
report
https://ubuntu.com/security/CVE-2023-52602
-
report
https://ubuntu.com/security/CVE-2023-52604
-
report
https://ubuntu.com/security/CVE-2023-52615
-
report
https://ubuntu.com/security/CVE-2024-2201
-
report
https://ubuntu.com/security/CVE-2024-26614
-
report
https://ubuntu.com/security/CVE-2024-26622
-
report
https://ubuntu.com/security/CVE-2024-26635
-
report
https://ubuntu.com/security/CVE-2024-26704
-
report
https://ubuntu.com/security/CVE-2024-26801
-
report
https://ubuntu.com/security/CVE-2024-26805