[USN-7028-2] Linux kernel (Azure) vulnerabilities
[USN-7073-2] Linux kernel (Azure) vulnerabilities
[USN-7074-1] Linux kernel (Azure) vulnerabilities
[USN-7069-2] Linux kernel (Azure) vulnerabilities
[USN-7076-1] Linux kernel (Azure) vulnerabilities
[USN-7059-2] OATH Toolkit vulnerability,External
[USN-7028-2] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7028-2
October 17, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash).
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Greybus drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- SCSI drivers;
- VFIO drivers;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Kernel debugger infrastructure;
- Bluetooth subsystem;
- IPv4 networking;
- L2TP protocol;
- Netfilter;
- RxRPC session sockets;
(CVE-2024-42154, CVE-2023-52527, CVE-2024-26733, CVE-2024-42160,
CVE-2021-47188, CVE-2024-38570, CVE-2024-26851, CVE-2024-26984,
CVE-2024-26677, CVE-2024-39480, CVE-2024-27398, CVE-2022-48791,
CVE-2024-42224, CVE-2024-38583, CVE-2024-40902, CVE-2023-52809,
CVE-2024-39495, CVE-2024-26651, CVE-2024-26880, CVE-2024-42228,
CVE-2024-27437, CVE-2022-48863)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS
linux-image-4.15.0-1181-azure 4.15.0-1181.196~14.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0-1181.196~14.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7028-2
https://ubuntu.com/security/notices/USN-7028-1
CVE-2021-47188, CVE-2022-48791, CVE-2022-48863, CVE-2023-52527,
CVE-2023-52809, CVE-2024-26651, CVE-2024-26677, CVE-2024-26733,
CVE-2024-26851, CVE-2024-26880, CVE-2024-26984, CVE-2024-27398,
CVE-2024-27437, CVE-2024-38570, CVE-2024-38583, CVE-2024-39480,
CVE-2024-39495, CVE-2024-40902, CVE-2024-42154, CVE-2024-42160,
CVE-2024-42224, CVE-2024-42228
[USN-7073-2] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7073-2
October 17, 2024
linux-azure, linux-azure-5.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Watchdog drivers;
- Netfilter;
- Memory management;
- Network traffic control;
(CVE-2024-27397, CVE-2024-38630, CVE-2024-45016, CVE-2024-26960)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
linux-image-5.4.0-1139-azure 5.4.0-1139.146
linux-image-azure-lts-20.04 5.4.0.1139.133
Ubuntu 18.04 LTS
linux-image-5.4.0-1139-azure 5.4.0-1139.146~18.04.1
Available with Ubuntu Pro
linux-image-azure 5.4.0.1139.146~18.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7073-2
https://ubuntu.com/security/notices/USN-7073-1
CVE-2024-26960, CVE-2024-27397, CVE-2024-38630, CVE-2024-45016
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1139.146
[USN-7074-1] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7074-1
October 17, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Microsoft Azure Network Adapter (MANA) driver;
- Network traffic control;
(CVE-2024-45016, CVE-2024-45001)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
linux-image-6.8.0-1016-azure 6.8.0-1016.18
linux-image-6.8.0-1016-azure-fde 6.8.0-1016.18
linux-image-azure 6.8.0-1016.18
linux-image-azure-fde 6.8.0-1016.18
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7074-1
CVE-2024-45001, CVE-2024-45016
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.8.0-1016.18
[USN-7069-2] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7069-2
October 17, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- Cryptographic API;
- CPU frequency scaling framework;
- HW tracing;
- ISDN/mISDN subsystem;
- Media drivers;
- Network drivers;
- NVME drivers;
- S/390 drivers;
- SCSI drivers;
- USB subsystem;
- VFIO drivers;
- Watchdog drivers;
- JFS file system;
- IRQ subsystem;
- Core kernel;
- Memory management;
- Amateur Radio drivers;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- Network traffic control;
- TIPC protocol;
- XFRM subsystem;
- Integrity Measurement Architecture(IMA) framework;
- SoC Audio for Freescale CPUs drivers;
- USB sound devices;
(CVE-2024-36971, CVE-2024-42271, CVE-2024-38630, CVE-2024-38602,
CVE-2024-42223, CVE-2024-44940, CVE-2023-52528, CVE-2024-41097,
CVE-2024-27051, CVE-2024-42157, CVE-2024-46673, CVE-2024-39494,
CVE-2024-42089, CVE-2024-41073, CVE-2024-26810, CVE-2024-26960,
CVE-2024-38611, CVE-2024-31076, CVE-2024-26754, CVE-2023-52510,
CVE-2024-40941, CVE-2024-45016, CVE-2024-38627, CVE-2024-38621,
CVE-2024-39487, CVE-2024-27436, CVE-2024-40901, CVE-2024-26812,
CVE-2024-42244, CVE-2024-42229, CVE-2024-43858, CVE-2024-42280,
CVE-2024-26641, CVE-2024-42284, CVE-2024-26602)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS
linux-image-4.15.0-1182-azure 4.15.0-1182.197~16.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0.1182.197~16.04.1
Available with Ubuntu Pro
Ubuntu 14.04 LTS
linux-image-4.15.0-1182-azure 4.15.0-1182.197~14.04.1
Available with Ubuntu Pro
linux-image-azure 4.15.0.1182.197~14.04.1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7069-2
https://ubuntu.com/security/notices/USN-7069-1
CVE-2023-52510, CVE-2023-52528, CVE-2024-26602, CVE-2024-26641,
CVE-2024-26754, CVE-2024-26810, CVE-2024-26812, CVE-2024-26960,
CVE-2024-27051, CVE-2024-27436, CVE-2024-31076, CVE-2024-36971,
CVE-2024-38602, CVE-2024-38611, CVE-2024-38621, CVE-2024-38627,
CVE-2024-38630, CVE-2024-39487, CVE-2024-39494, CVE-2024-40901,
CVE-2024-40941, CVE-2024-41073, CVE-2024-41097, CVE-2024-42089,
CVE-2024-42157, CVE-2024-42223, CVE-2024-42229, CVE-2024-42244,
CVE-2024-42271, CVE-2024-42280, CVE-2024-42284, CVE-2024-43858,
CVE-2024-44940, CVE-2024-45016, CVE-2024-46673
[USN-7076-1] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7076-1
October 17, 2024
linux-azure, linux-azure-5.15 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-azure-5.15: Linux kernel for Microsoft Azure cloud systems
Details:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Microsoft Azure Network Adapter (MANA) driver;
- Watchdog drivers;
- Netfilter;
- Network traffic control;
(CVE-2024-27397, CVE-2024-45016, CVE-2024-45001, CVE-2024-38630)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
linux-image-5.15.0-1074-azure 5.15.0-1074.83
linux-image-azure-lts-22.04 5.15.0.1074.72
Ubuntu 20.04 LTS
linux-image-5.15.0-1074-azure 5.15.0-1074.83~20.04.1
linux-image-azure 5.15.0.1074.83~20.04.1
linux-image-azure-cvm 5.15.0.1074.83~20.04.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-7076-1
CVE-2024-27397, CVE-2024-38630, CVE-2024-45001, CVE-2024-45016
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/5.15.0-1074.83
https://launchpad.net/ubuntu/+source/linux-azure-5.15/5.15.0-1074.83~20.04.1
[USN-7059-2] OATH Toolkit vulnerability,External
==========================================================================
Ubuntu Security Notice USN-7059-2
October 17, 2024
oath-toolkit vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
Summary:
OATH Toolkit could be made to overwrite files as the administrator.
Software Description:
- oath-toolkit: Development files for the OATH Toolkit Liboath library
Details:
USN-7059-1 fixed a vulnerability in OATH Toolkit library. This
update provides the corresponding update for Ubuntu 24.10.
Original advisory details:
Fabian Vogt discovered that OATH Toolkit incorrectly handled file
permissions. A remote attacker could possibly use this issue to
overwrite root owned files, leading to a privilege escalation attack.
(CVE-2024-47191)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
liboath-dev 2.6.11-3ubuntu1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7059-2
( https://ubuntu.com/security/notices/USN-7059-2)
https://ubuntu.com/security/notices/USN-7059-1
( https://ubuntu.com/security/notices/USN-7059-1)
CVE-2024-47191
Package Information:
https://launchpad.net/ubuntu/+source/oath-toolkit/2.6.11-3ubuntu1
( https://launchpad.net/ubuntu/+source/oath-toolkit/2.6.11-3ubuntu1)
