Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- Cryptographic API;
- CPU frequency scaling framework;
- HW tracing;
- ISDN/mISDN subsystem;
- Media drivers;
- Network drivers;
- NVME drivers;
- S/390 drivers;
- SCSI drivers;
- USB subsystem;
- VFIO drivers;
- Watchdog drivers;
- JFS file system;
- IRQ subsystem;
- Core kernel;
- Memory management;
- Amateur Radio drivers;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- Network traffic control;
- TIPC protocol;
- XFRM subsystem;
- Integrity Measurement Architecture(IMA) framework;
- SoC Audio for Freescale CPUs drivers;
- USB sound devices;
(CVE-2024-36971, CVE-2024-42271, CVE-2024-38630, CVE-2024-38602,
CVE-2024-42223, CVE-2024-44940, CVE-2023-52528, CVE-2024-41097,
CVE-2024-27051, CVE-2024-42157, CVE-2024-46673, CVE-2024-39494,
CVE-2024-42089, CVE-2024-41073, CVE-2024-26810, CVE-2024-26960,
CVE-2024-38611, CVE-2024-31076, CVE-2024-26754, CVE-2023-52510,
CVE-2024-40941, CVE-2024-45016, CVE-2024-38627, CVE-2024-38621,
CVE-2024-39487, CVE-2024-27436, CVE-2024-40901, CVE-2024-26812,
CVE-2024-42244, CVE-2024-42229, CVE-2024-43858, CVE-2024-42280,
CVE-2024-26641, CVE-2024-42284, CVE-2024-26602)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-azure | 4.15.0-1182.197~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1182.197~16.04.1 |
Vulnerabilities 35
-
High 7.8
net: fix __dst_negative_advice() race
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…
KEV Aug 7, 2024 -
Critical 9.8
nvme: avoid double free special payload
In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECI…
-
Critical 9.1
tipc: Return non-zero value from tipc_udp_addr2str() on error
In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occ…
-
High 8.6
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h varia…
-
High 8.1
wifi: iwlwifi: mvm: don't read past the mfuart notifcation
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the not…
-
High 7.8
vfio/pci: Lock external INTx masking ops
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outs…
-
High 7.8
vfio/pci: Create persistent INTx handler
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Create persistent INTx handler A vulnerability exists where the eventfd for INTx signaling can be deconfigured, which unregisters the IRQ handler but still allows eventfds to be sig…
-
High 7.8
ima: Fix use-after-free on a dentry's dname.name
In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->…
-
High 7.8
net/iucv: fix use after free in iucv_sock_close()
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of…
-
High 7.8
mISDN: Fix a use after free in hfcmulti_tx()
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp).
-
High 7.8
jfs: Fix array-index-out-of-bounds in diFree
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix array-index-out-of-bounds in diFree
-
High 7.8
netem: fix return value if duplicate enqueue fails
In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to…
-
High 7.8
scsi: aacraid: Fix double-free on probe failure
In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_ini…
-
High 7.5
fou: remove warn in gue_gro_receive on unsupported protocol
In the Linux kernel, the following vulnerability has been resolved: fou: remove warn in gue_gro_receive on unsupported protocol Drop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is not known or does not have a GRO handler. Such a packet is ea…
-
High 7.3
media: i2c: et8ek8: Don't strip remove function when driver is builtin
In the Linux kernel, the following vulnerability has been resolved: media: i2c: et8ek8: Don't strip remove function when driver is builtin Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When suc…
-
High 7.3
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions …
-
High 7.1
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte…
-
High 7.0
mm: swap: fix race between free_swap_and_cache() and swapoff()
In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_an…
-
Medium 5.3
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.
-
Unscored —
ieee802154: ca8210: Fix a potential UAF in ca8210_probe
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. How…
-
Unscored —
net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: u…
-
Unscored —
sched/membarrier: reduce the ability to hammer on sys_membarrier
In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …
-
Unscored —
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink famil…
-
Unscored —
cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return 0 in case of error. Found by Linux Ve…
-
Unscored —
genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instea…
-
Unscored —
ax25: Fix reference count leak issues of ax25_dev
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25_dev The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference count leak issue of the object "ax25_dev". Memory leak issue in ax25_add…
-
Unscored —
media: stk1160: fix bounds checking in stk1160_copy_video()
In the Linux kernel, the following vulnerability has been resolved: media: stk1160: fix bounds checking in stk1160_copy_video() The subtract in this condition is reversed. The ->length is the length of the buffer. The ->bytesused is how many bytes we have cop…
-
Unscored —
stm class: Fix a double free in stm_register_device()
In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free.
-
Unscored —
watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If the timer handler is r…
-
Unscored —
usb: atm: cxacru: fix endpoint checking in cxacru_bind()
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpo…
-
Unscored —
ASoC: fsl-asoc-card: set priv->pdev before using it
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl-asoc-card: set priv->pdev before using it priv->pdev pointer was set after being used in fsl_asoc_card_audmux_init(). Move this assignment at the start of the probe function, so sub…
-
Unscored —
s390/pkey: Wipe sensitive data on failure
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data on failure Wipe sensitive data from stack also if the copy_to_user() fails.
-
Unscored —
media: dvb-frontends: tda10048: Fix integer overflow
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: tda10048: Fix integer overflow state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold …
-
Unscored —
crypto: aead,cipher - zeroize key buffer after use
In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer n…
-
Unscored —
USB: serial: mos7840: fix crash on resume
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic re…
References
-
report
https://ubuntu.com/security/CVE-2023-52510
-
report
https://ubuntu.com/security/CVE-2023-52528
-
report
https://ubuntu.com/security/CVE-2024-26602
-
report
https://ubuntu.com/security/CVE-2024-26641
-
report
https://ubuntu.com/security/CVE-2024-26754
-
report
https://ubuntu.com/security/CVE-2024-26810
-
report
https://ubuntu.com/security/CVE-2024-26812
-
report
https://ubuntu.com/security/CVE-2024-26960
-
report
https://ubuntu.com/security/CVE-2024-27051
-
report
https://ubuntu.com/security/CVE-2024-27436
-
report
https://ubuntu.com/security/CVE-2024-31076
-
report
https://ubuntu.com/security/CVE-2024-36971
-
report
https://ubuntu.com/security/CVE-2024-38602
-
report
https://ubuntu.com/security/CVE-2024-38611
-
report
https://ubuntu.com/security/CVE-2024-38621
-
report
https://ubuntu.com/security/CVE-2024-38627
-
report
https://ubuntu.com/security/CVE-2024-38630
-
report
https://ubuntu.com/security/CVE-2024-39487
-
report
https://ubuntu.com/security/CVE-2024-39494
-
report
https://ubuntu.com/security/CVE-2024-40901
-
report
https://ubuntu.com/security/CVE-2024-40941
-
report
https://ubuntu.com/security/CVE-2024-41073
-
report
https://ubuntu.com/security/CVE-2024-41097
-
report
https://ubuntu.com/security/CVE-2024-42089
-
report
https://ubuntu.com/security/CVE-2024-42157
-
report
https://ubuntu.com/security/CVE-2024-42223
-
report
https://ubuntu.com/security/CVE-2024-42229
-
report
https://ubuntu.com/security/CVE-2024-42244
-
report
https://ubuntu.com/security/CVE-2024-42271
-
report
https://ubuntu.com/security/CVE-2024-42280
-
report
https://ubuntu.com/security/CVE-2024-42284
-
report
https://ubuntu.com/security/CVE-2024-43858
-
report
https://ubuntu.com/security/CVE-2024-44940
-
report
https://ubuntu.com/security/CVE-2024-45016
-
report
https://ubuntu.com/security/CVE-2024-46673