SB2023032426 - Ubuntu update for linux

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Improper Initialization (CVE-ID: CVE-2022-2196)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper initialization within nVMX in Linux kernel. A local user can perform speculative execution attacks and escalate privileges on the system.

2) Resource management error (CVE-ID: CVE-2022-42328)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

3) Resource management error (CVE-ID: CVE-2022-42329)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

4) Use-after-free (CVE-ID: CVE-2022-4382)

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the gadgetfs Linux driver. An attacker with physical access to the system can trigger a use-after-free by manipulating the external device with gadgetfs and execute arbitrary code.

5) Security features bypass (CVE-ID: CVE-2023-0045)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to Linux kernel does not correctly mitigate SMT attacks. A local user can bypass Spectre-BTI user space mitigations and gain access to sensitive information.

6) Use-after-free (CVE-ID: CVE-2023-0266)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the snd_ctl_elem_read() function in the Linux kernel sound subsystem. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

7) Use-after-free (CVE-ID: CVE-2023-0469)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error during the cleanup call within the io_install_fixed_file() function in io_uring/filetable.c. A local user can trigger a use-after-free error and perform a denial of service (DoS) attack.

8) Use-after-free (CVE-ID: CVE-2023-1195)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the reconn_set_ipaddr_from_hostname() function in fs/cifs/connect.c in Linux kernel. A local user can perform a denial of service (DoS) attack.

9) Integer overflow (CVE-ID: CVE-2023-23559)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the rndis_query_oid() function in drivers/net/wireless/rndis_wlan.c. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-5970-1