Summary
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Network drivers;
- SCSI subsystem;
- Ext4 file system;
- Bluetooth subsystem;
- Memory management;
- Amateur Radio drivers;
- Network traffic control;
- Sun RPC protocol;
- VMware vSockets driver;
(CVE-2023-52821, CVE-2024-40910, CVE-2024-43892, CVE-2024-49967,
CVE-2024-50264, CVE-2024-36952, CVE-2024-38553, CVE-2021-47101,
CVE-2021-47001, CVE-2024-35965, CVE-2024-35963, CVE-2024-35966,
CVE-2024-35967, CVE-2024-53057, CVE-2024-38597)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws | 5.4.0-1137.147 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-bluefield | 5.4.0-1097.104 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-ibm | 5.4.0-1084.89 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-oracle | 5.4.0-1136.145 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-xilinx-zynqmp | 5.4.0-1056.60 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws-5.4 | 5.4.0-1137.147~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-ibm-5.4 | 5.4.0-1084.89~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle-5.4 | 5.4.0-1136.145~18.04.1 |
Vulnerabilities 16
-
High 8.8
ax25: Fix refcount imbalance on inbound connections
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execu…
-
High 7.8
memcg: protect concurrent access to mem_cgroup_idr
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to f…
-
High 7.8
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After…
-
High 7.8
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it…
-
High 7.5
xprtrdma: Fix cwnd update ordering
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix cwnd update ordering After a reconnect, the reply handler is opening the cwnd (and thus enabling more RPC Calls to be sent) /before/ rpcrdma_post_recvs() can post enough Receive…
-
High 7.1
Bluetooth: hci_sock: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length before copying data.
-
High 7.1
Bluetooth: SCO: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_…
-
Medium 6.3
There is a NULL pointer vulnerability in vmwgfx driver
A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…
-
Unscored —
asix: fix uninit-value in asix_mdio_read()
In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asix_mdio_read() asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized. Fail log: BUG: KMSAN: uninit-value in asix_check_…
-
Unscored —
drm/panel: fix a possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/panel: fix a possible null pointer dereference In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference …
-
Unscored —
Bluetooth: L2CAP: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user input length before copying data.
-
Unscored —
Bluetooth: RFCOMM: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in …
-
Unscored —
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This…
-
Unscored —
net: fec: remove .ndo_poll_controller to avoid deadlocks
In the Linux kernel, the following vulnerability has been resolved: net: fec: remove .ndo_poll_controller to avoid deadlocks There is a deadlock issue found in sungem driver, please refer to the commit ac0a230f719b ("eth: sungem: remove .ndo_poll_controller t…
-
Unscored —
eth: sungem: remove .ndo_poll_controller to avoid deadlocks
In the Linux kernel, the following vulnerability has been resolved: eth: sungem: remove .ndo_poll_controller to avoid deadlocks Erhard reports netpoll warnings from sungem: netpoll_send_skb_on_dev(): eth0 enabled interrupts in poll (gem_start_xmit+0x0/0x398) …
-
Unscored —CVE-2024-49967 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
References
-
report
https://ubuntu.com/security/CVE-2021-47001
-
report
https://ubuntu.com/security/CVE-2021-47101
-
report
https://ubuntu.com/security/CVE-2022-38096
-
report
https://ubuntu.com/security/CVE-2023-52821
-
report
https://ubuntu.com/security/CVE-2024-35963
-
report
https://ubuntu.com/security/CVE-2024-35965
-
report
https://ubuntu.com/security/CVE-2024-35966
-
report
https://ubuntu.com/security/CVE-2024-35967
-
report
https://ubuntu.com/security/CVE-2024-36952
-
report
https://ubuntu.com/security/CVE-2024-38553
-
report
https://ubuntu.com/security/CVE-2024-38597
-
report
https://ubuntu.com/security/CVE-2024-40910
-
report
https://ubuntu.com/security/CVE-2024-43892
-
report
https://ubuntu.com/security/CVE-2024-49967
-
report
https://ubuntu.com/security/CVE-2024-50264
-
report
https://ubuntu.com/security/CVE-2024-53057