-
Notifications
You must be signed in to change notification settings - Fork 0
/
USN-6013-1.json
307 lines (307 loc) · 20 KB
/
USN-6013-1.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
{
"id": "USN-6013-1",
"summary": "linux-aws vulnerabilities",
"details": "Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP\nimplementation in the Linux kernel did not properly handle IPID assignment.\nA remote attacker could use this to cause a denial of service (connection\ntermination) or inject forged data. (CVE-2020-36516)\n\nKe Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,\nLisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre\nVariant 2 mitigations for AMD processors on Linux were insufficient in some\nsituations. A local attacker could possibly use this to expose sensitive\ninformation. (CVE-2021-26401)\n\nJ\u00fcrgen Gro\u00df discovered that the Xen subsystem within the Linux kernel did\nnot adequately limit the number of events driver domains (unprivileged PV\nbackends) could send to other guest VMs. An attacker in a driver domain\ncould use this to cause a denial of service in other guest VMs.\n(CVE-2021-28712, CVE-2021-28713)\n\nWolfgang Frisch discovered that the ext4 file system implementation in the\nLinux kernel contained an integer overflow when handling metadata inode\nextents. An attacker could use this to construct a malicious ext4 file\nsystem image that, when mounted, could cause a denial of service (system\ncrash). (CVE-2021-3428)\n\nIt was discovered that the IEEE 802.15.4 wireless network subsystem in the\nLinux kernel did not properly handle certain error conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2021-3659)\n\nIt was discovered that the System V IPC implementation in the Linux kernel\ndid not properly handle large shared memory counts. A local attacker could\nuse this to cause a denial of service (memory exhaustion). (CVE-2021-3669)\n\nAlois Wohlschlager discovered that the overlay file system in the Linux\nkernel did not restrict private clones in some situations. An attacker\ncould use this to expose sensitive information. (CVE-2021-3732)\n\nIt was discovered that the SCTP protocol implementation in the Linux kernel\ndid not properly verify VTAGs in some situations. A remote attacker could\npossibly use this to cause a denial of service (connection disassociation).\n(CVE-2021-3772)\n\nIt was discovered that the btrfs file system implementation in the Linux\nkernel did not properly handle locking in certain error conditions. A local\nattacker could use this to cause a denial of service (kernel deadlock).\n(CVE-2021-4149)\n\nJann Horn discovered that the socket subsystem in the Linux kernel\ncontained a race condition when handling listen() and connect() operations,\nleading to a read-after-free vulnerability. A local attacker could use this\nto cause a denial of service (system crash) or possibly expose sensitive\ninformation. (CVE-2021-4203)\n\nIt was discovered that the file system quotas implementation in the Linux\nkernel did not properly validate the quota block number. An attacker could\nuse this to construct a malicious file system image that, when mounted and\noperated on, could cause a denial of service (system crash).\n(CVE-2021-45868)\n\nZhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did\nnot properly handle device removal, leading to a use-after-free\nvulnerability. A physically proximate attacker could possibly use this to\ncause a denial of service (system crash). (CVE-2022-0487)\n\nIt was discovered that the block layer subsystem in the Linux kernel did\nnot properly initialize memory in some situations. A privileged local\nattacker could use this to expose sensitive information (kernel memory).\n(CVE-2022-0494)\n\nIt was discovered that the UDF file system implementation in the Linux\nkernel could attempt to dereference a null pointer in some situations. An\nattacker could use this to construct a malicious UDF image that, when\nmounted and operated on, could cause a denial of service (system crash).\n(CVE-2022-0617)\n\nDavid Bouman discovered that the netfilter subsystem in the Linux kernel\ndid not initialize memory in some situations. A local attacker could use\nthis to expose sensitive information (kernel memory). (CVE-2022-1016)\n\nIt was discovered that the implementation of the 6pack and mkiss protocols\nin the Linux kernel did not handle detach events properly in some\nsituations, leading to a use-after-free vulnerability. A local attacker\ncould possibly use this to cause a denial of service (system crash).\n(CVE-2022-1195)\n\nDuoming Zhou discovered race conditions in the AX.25 amateur radio protocol\nimplementation in the Linux kernel, leading to use-after-free\nvulnerabilities. A local attacker could possibly use this to cause a denial\nof service (system crash). (CVE-2022-1205)\n\nIt was discovered that the tty subsystem in the Linux kernel contained a\nrace condition in certain situations, leading to an out-of-bounds read\nvulnerability. A local attacker could possibly use this to cause a denial\nof service (system crash) or expose sensitive information. (CVE-2022-1462)\n\nIt was discovered that the implementation of X.25 network protocols in the\nLinux kernel did not terminate link layer sessions properly. A local\nattacker could possibly use this to cause a denial of service (system\ncrash). (CVE-2022-1516)\n\nDuoming Zhou discovered a race condition in the NFC subsystem in the Linux\nkernel, leading to a use-after-free vulnerability. A privileged local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2022-1974)\n\nDuoming Zhou discovered that the NFC subsystem in the Linux kernel did not\nproperly prevent context switches from occurring during certain atomic\ncontext operations. A privileged local attacker could use this to cause a\ndenial of service (system crash). (CVE-2022-1975)\n\nIt was discovered that the HID subsystem in the Linux kernel did not\nproperly validate inputs in certain conditions. A local attacker with\nphysical access could plug in a specially crafted USB device to expose\nsensitive information. (CVE-2022-20132)\n\nIt was discovered that the device-mapper verity (dm-verity) driver in the\nLinux kernel did not properly verify targets being loaded into the device-\nmapper table. A privileged attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2022-20572,\nCVE-2022-2503)\n\nDuoming Zhou discovered that race conditions existed in the timer handling\nimplementation of the Linux kernel's Rose X.25 protocol layer, resulting in\nuse-after-free vulnerabilities. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2022-2318)\n\nZheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the\nLinux kernel did not properly handle very small reads. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2022-2380)\n\nDavid Leadbeater discovered that the netfilter IRC protocol tracking\nimplementation in the Linux Kernel incorrectly handled certain message\npayloads in some situations. A remote attacker could possibly use this to\ncause a denial of service or bypass firewall filtering. (CVE-2022-2663)\n\nLucas Leong discovered that the LightNVM subsystem in the Linux kernel did\nnot properly handle data lengths in certain situations. A privileged\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2022-2991)\n\nIt was discovered that the Intel 740 frame buffer driver in the Linux\nkernel contained a divide by zero vulnerability. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2022-3061)\n\nJiasheng Jiang discovered that the wm8350 charger driver in the Linux\nkernel did not properly deallocate memory, leading to a null pointer\ndereference vulnerability. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2022-3111)\n\nIt was discovered that the sound subsystem in the Linux kernel contained a\nrace condition in some situations. A local attacker could use this to cause\na denial of service (system crash). (CVE-2022-3303)\n\nIt was discovered that the Broadcom FullMAC USB WiFi driver in the Linux\nkernel did not properly perform bounds checking in some situations. A\nphysically proximate attacker could use this to craft a malicious USB\ndevice that when inserted, could cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2022-3628)\n\nZiming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux\nkernel contained an out-of-bounds write vulnerability. A local attacker\ncould use this to cause a denial of service (system crash).\n(CVE-2022-36280)\n\nIt was discovered that the NILFS2 file system implementation in the Linux\nkernel did not properly deallocate memory in certain error conditions. An\nattacker could use this to cause a denial of service (memory exhaustion).\n(CVE-2022-3646)\n\nIt was discovered that the Netlink Transformation (XFRM) subsystem in the\nLinux kernel contained a reference counting error. A local attacker could\nuse this to cause a denial of service (system crash). (CVE-2022-36879)\n\nIt was discovered that the infrared transceiver USB driver did not properly\nhandle USB control messages. A local attacker with physical access could\nplug in a specially crafted USB device to cause a denial of service (memory\nexhaustion). (CVE-2022-3903)\n\nJann Horn discovered a race condition existed in the Linux kernel when\nunmapping VMAs in certain situations, resulting in possible use-after-free\nvulnerabilities. A local attacker could possibly use this to cause a denial\nof service (system crash) or execute arbitrary code. (CVE-2022-39188)\n\nHyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not\nproperly perform reference counting in some situations, leading to a use-\nafter-free vulnerability. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2022-41218)\n\nIt was discovered that a race condition existed in the SMSC UFX USB driver\nimplementation in the Linux kernel, leading to a use-after-free\nvulnerability. A physically proximate attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2022-41849)\n\nIt was discovered that a race condition existed in the Roccat HID driver in\nthe Linux kernel, leading to a use-after-free vulnerability. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2022-41850)\n\nIt was discovered that the USB core subsystem in the Linux kernel did not\nproperly handle nested reset events. A local attacker with physical access\ncould plug in a specially crafted USB device to cause a denial of service\n(kernel deadlock). (CVE-2022-4662)\n\nIt was discovered that the network queuing discipline implementation in the\nLinux kernel contained a null pointer dereference in some situations. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2022-47929)\n\nKyle Zeng discovered that the IPv6 implementation in the Linux kernel\ncontained a NULL pointer dereference vulnerability in certain situations. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2023-0394)\n\nIt was discovered that a memory leak existed in the SCTP protocol\nimplementation in the Linux kernel. A local attacker could use this to\ncause a denial of service (memory exhaustion). (CVE-2023-1074)\n\nMingi Cho discovered that the netfilter subsystem in the Linux kernel did\nnot properly initialize a data structure, leading to a null pointer\ndereference vulnerability. An attacker could use this to cause a denial of\nservice (system crash). (CVE-2023-1095)\n\nKyle Zeng discovered that the ATM VC queuing discipline implementation in\nthe Linux kernel contained a type confusion vulnerability in some\nsituations. An attacker could use this to cause a denial of service (system\ncrash). (CVE-2023-23455)\n\nLianhui Tang discovered that the MPLS implementation in the Linux kernel\ndid not properly handle certain sysctl allocation failure conditions,\nleading to a double-free vulnerability. An attacker could use this to cause\na denial of service or possibly execute arbitrary code. (CVE-2023-26545)\n\nIt was discovered that the NTFS file system implementation in the Linux\nkernel did not properly validate attributes in certain situations, leading\nto an out-of-bounds read vulnerability. A local attacker could possibly use\nthis to expose sensitive information (kernel memory). (CVE-2023-26607)\n\nDuoming Zhou discovered that a race condition existed in the infrared\nreceiver/transceiver driver in the Linux kernel, leading to a use-after-\nfree vulnerability. A privileged attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2023-1118)\n\n",
"aliases": [],
"related": [
"CVE-2020-36516",
"CVE-2021-26401",
"CVE-2021-28712",
"CVE-2021-28713",
"CVE-2021-3428",
"CVE-2021-3659",
"CVE-2021-3669",
"CVE-2021-3732",
"CVE-2021-3772",
"CVE-2021-4149",
"CVE-2021-4203",
"CVE-2021-45868",
"CVE-2022-0487",
"CVE-2022-0494",
"CVE-2022-0617",
"CVE-2022-1016",
"CVE-2022-1195",
"CVE-2022-1205",
"CVE-2022-1462",
"CVE-2022-1516",
"CVE-2022-1974",
"CVE-2022-1975",
"CVE-2022-20132",
"CVE-2022-20572",
"CVE-2022-2318",
"CVE-2022-2380",
"CVE-2022-2503",
"CVE-2022-2663",
"CVE-2022-2991",
"CVE-2022-3061",
"CVE-2022-3111",
"CVE-2022-3303",
"CVE-2022-3628",
"CVE-2022-36280",
"CVE-2022-3646",
"CVE-2022-36879",
"CVE-2022-3903",
"CVE-2022-39188",
"CVE-2022-41218",
"CVE-2022-41849",
"CVE-2022-41850",
"CVE-2022-4662",
"CVE-2022-47929",
"CVE-2023-0394",
"CVE-2023-1074",
"CVE-2023-1095",
"CVE-2023-1118",
"CVE-2023-23455",
"CVE-2023-26545",
"CVE-2023-26607"
],
"published": "2023-04-12T14:41:24.220213Z",
"modified": "2023-04-12T14:41:24.220213Z",
"affected": [
{
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "linux-aws"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.0-1117.123"
}
]
}
],
"ecosystem_specific": {
"binaries": [
{
"linux-tools-aws": "4.4.0.1117.114",
"linux-tools-4.4.0-1117-aws": "4.4.0-1117.123",
"linux-buildinfo-4.4.0-1117-aws": "4.4.0-1117.123",
"linux-cloud-tools-4.4.0-1117-aws": "4.4.0-1117.123",
"linux-aws-tools-4.4.0-1117": "4.4.0-1117.123",
"linux-aws-headers-4.4.0-1117": "4.4.0-1117.123",
"linux-headers-4.4.0-1117-aws": "4.4.0-1117.123",
"linux-modules-4.4.0-1117-aws": "4.4.0-1117.123",
"linux-headers-aws": "4.4.0.1117.114",
"linux-image-aws": "4.4.0.1117.114",
"linux-aws-cloud-tools-4.4.0-1117": "4.4.0-1117.123",
"linux-aws": "4.4.0.1117.114",
"linux-image-4.4.0-1117-aws": "4.4.0-1117.123"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-6013-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-36516"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-26401"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-28712"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-28713"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-3428"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-3659"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-3669"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-3732"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-3772"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-4149"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-4203"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-45868"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-0487"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-0494"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-0617"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1016"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1195"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1205"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1462"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1516"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1974"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1975"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-20132"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-20572"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-2318"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-2380"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-2503"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-2663"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-2991"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-3061"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-3111"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-3303"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-3628"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-36280"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-3646"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-36879"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-3903"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-39188"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-41218"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-41849"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-41850"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-4662"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-47929"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-0394"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-1074"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-1095"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-1118"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-23455"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-26545"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2023-26607"
}
]
}