[USN-6697-1] Bash vulnerability
[USN-6700-1] Linux kernel vulnerabilities
[USN-6701-1] Linux kernel vulnerabilities
[USN-6699-1] Linux kernel vulnerabilities
[USN-6698-1] Vim vulnerability
[USN-6697-1] Bash vulnerability
==========================================================================
Ubuntu Security Notice USN-6697-1
March 18, 2024
bash vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Bash could be made to crash or run programs as your login if it opened a
specially crafted file.
Software Description:
- bash: GNU Bourne Again SHell
Details:
It was discovered that Bash incorrectly handled certain memory operations
when processing commands. If a user or automated system were tricked into
running a specially crafted bash file, a remote attacker could use this
issue to cause Bash to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
bash 5.1-6ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6697-1
CVE-2022-3715
Package Information:
https://launchpad.net/ubuntu/+source/bash/5.1-6ubuntu1.1
[USN-6700-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6700-1
March 18, 2024
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-kvm: Linux kernel for cloud environments
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation
in the Linux kernel contained a race condition when releasing PPPoL2TP
sockets in certain conditions, leading to a use-after-free vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20567)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle block device modification while it is
mounted. A privileged attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-34256)
Eric Dumazet discovered that the netfilter subsystem in the Linux kernel
did not properly handle DCCP conntrack buffers in certain situations,
leading to an out-of-bounds read vulnerability. An attacker could possibly
use this to expose sensitive information (kernel memory). (CVE-2023-39197)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle the remount operation in certain cases,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2024-0775)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
linux-image-4.4.0-1130-kvm 4.4.0-1130.140
linux-image-4.4.0-252-generic 4.4.0-252.286
linux-image-4.4.0-252-lowlatency 4.4.0-252.286
linux-image-generic 4.4.0.252.258
linux-image-generic-lts-xenial 4.4.0.252.258
linux-image-kvm 4.4.0.1130.127
linux-image-lowlatency 4.4.0.252.258
linux-image-lowlatency-lts-xenial 4.4.0.252.258
linux-image-virtual 4.4.0.252.258
linux-image-virtual-lts-xenial 4.4.0.252.258
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
linux-image-4.4.0-1129-aws 4.4.0-1129.135
linux-image-4.4.0-252-generic 4.4.0-252.286~14.04.1
linux-image-4.4.0-252-lowlatency 4.4.0-252.286~14.04.1
linux-image-aws 4.4.0.1129.126
linux-image-generic-lts-xenial 4.4.0.252.219
linux-image-lowlatency-lts-xenial 4.4.0.252.219
linux-image-virtual-lts-xenial 4.4.0.252.219
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6700-1
CVE-2022-20567, CVE-2023-34256, CVE-2023-39197, CVE-2023-51781,
CVE-2024-0775, CVE-2024-1086, CVE-2024-24855
[USN-6701-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6701-1
March 18, 2024
linux, linux-aws, linux-hwe, linux-kvm, linux-oracle vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did
not properly perform permissions checks when handling HCI sockets. A
physically proximate attacker could use this to cause a denial of service
(bluetooth communication). (CVE-2023-2002)
It was discovered that the NVIDIA Tegra XUSB pad controller driver in the
Linux kernel did not properly handle return values in certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-23000)
It was discovered that Spectre-BHB mitigations were missing for Ampere
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2023-3006)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle block device modification while it is
mounted. A privileged attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-34256)
Eric Dumazet discovered that the netfilter subsystem in the Linux kernel
did not properly handle DCCP conntrack buffers in certain situations,
leading to an out-of-bounds read vulnerability. An attacker could possibly
use this to expose sensitive information (kernel memory). (CVE-2023-39197)
It was discovered that the Siano USB MDTV receiver device driver in the
Linux kernel did not properly handle device initialization failures in
certain situations, leading to a use-after-free vulnerability. A physically
proximate attacker could use this cause a denial of service (system crash).
(CVE-2023-4132)
Pratyush Yadav discovered that the Xen network backend implementation in
the Linux kernel did not properly handle zero length data request, leading
to a null pointer dereference vulnerability. An attacker in a guest VM
could possibly use this to cause a denial of service (host domain crash).
(CVE-2023-46838)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel
did not properly handle connect command payloads in certain situations,
leading to an out-of-bounds read vulnerability. A remote attacker could use
this to expose sensitive information (kernel memory). (CVE-2023-6121)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle the remount operation in certain cases,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2024-0775)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
linux-image-4.15.0-1129-oracle 4.15.0-1129.140
linux-image-4.15.0-1150-kvm 4.15.0-1150.155
linux-image-4.15.0-1166-aws 4.15.0-1166.179
linux-image-4.15.0-223-generic 4.15.0-223.235
linux-image-4.15.0-223-lowlatency 4.15.0-223.235
linux-image-aws-lts-18.04 4.15.0.1166.164
linux-image-generic 4.15.0.223.207
linux-image-kvm 4.15.0.1150.141
linux-image-lowlatency 4.15.0.223.207
linux-image-oracle-lts-18.04 4.15.0.1129.134
linux-image-virtual 4.15.0.223.207
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
linux-image-4.15.0-223-generic 4.15.0-223.235~16.04.1
linux-image-4.15.0-223-lowlatency 4.15.0-223.235~16.04.1
linux-image-generic-hwe-16.04 4.15.0.223.7
linux-image-lowlatency-hwe-16.04 4.15.0.223.7
linux-image-oem 4.15.0.223.7
linux-image-virtual-hwe-16.04 4.15.0.223.7
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6701-1
CVE-2023-2002, CVE-2023-23000, CVE-2023-3006, CVE-2023-34256,
CVE-2023-39197, CVE-2023-4132, CVE-2023-46838, CVE-2023-51781,
CVE-2023-6121, CVE-2024-0775, CVE-2024-1086, CVE-2024-24855
[USN-6699-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6699-1
March 18, 2024
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
Details:
Reima Ishii discovered that the nested KVM implementation for Intel x86
processors in the Linux kernel did not properly validate control registers
in certain situations. An attacker in a guest VM could use this to cause a
denial of service (guest crash). (CVE-2023-30456)
It was discovered that the Quick Fair Queueing scheduler implementation in
the Linux kernel did not properly handle network packets in certain
conditions, leading to a use after free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-4921)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
linux-image-3.13.0-197-generic 3.13.0-197.248
linux-image-3.13.0-197-lowlatency 3.13.0-197.248
linux-image-generic 3.13.0.197.207
linux-image-generic-lts-trusty 3.13.0.197.207
linux-image-lowlatency 3.13.0.197.207
linux-image-server 3.13.0.197.207
linux-image-virtual 3.13.0.197.207
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6699-1
CVE-2023-30456, CVE-2023-4921, CVE-2024-24855
[USN-6698-1] Vim vulnerability
==========================================================================
Ubuntu Security Notice USN-6698-1
March 18, 2024
vim vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Vim could be made to crash if it opened a specially crafted file.
Software Description:
- vim: Vi IMproved - enhanced vi editor
Details:
Zhen Zhou discovered that Vim did not properly manage memory. An
attacker could possibly use this issue to cause a denial of service
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
vim 2:9.0.1672-1ubuntu2.3
Ubuntu 22.04 LTS:
vim 2:8.2.3995-1ubuntu2.16
Ubuntu 20.04 LTS:
vim 2:8.1.2269-1ubuntu5.22
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
vim 2:8.0.1453-1ubuntu1.13+esm8
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
vim 2:7.4.1689-3ubuntu1.5+esm23
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
vim 2:7.4.052-1ubuntu3.1+esm16
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6698-1
CVE-2024-22667
Package Information:
https://launchpad.net/ubuntu/+source/vim/2:9.0.1672-1ubuntu2.3
https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.16
https://launchpad.net/ubuntu/+source/vim/2:8.1.2269-1ubuntu5.22
