SB2023053055 - Ubuntu update for linux-oem-6.0

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2023-1670)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Xircom 16-bit PCMCIA (PC-card) Ethernet driver. A local user can trigger a use-after-free error and execute arbitrary code on the system.

2) Race condition (CVE-ID: CVE-2023-2612)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the shiftfs filesystem when handling inode locking in some
situations. A local user can exploit the race and cause a denial of service (kernel deadlock).

3) Use-after-free (CVE-ID: CVE-2023-26606)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ntfs_trim_fs() function in fs/ntfs3/bitmap.c in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

4) Input validation error (CVE-ID: CVE-2023-30456)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of consistency for for CR0 and CR4 in arch/x86/kvm/vmx/nested.c in the Linux kernel. A local user can execute arbitrary code with elevated privileges.

5) Use-after-free (CVE-ID: CVE-2023-32233)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Netfilter nf_tables when processing batch requests. A local user can trigger a use-after-free error and execute arbitrary code with root privileges.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-6123-1