[USN-6795-1] Linux kernel (Intel IoTG) vulnerabilities
[USN-6792-1] Flask-Security vulnerability
[USN-6794-1] FRR vulnerabilities
[USN-6793-1] Git vulnerabilities
[USN-6795-1] Linux kernel (Intel IoTG) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6795-1
May 28, 2024
linux-intel-iotg vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-intel-iotg: Linux kernel for Intel IoT platforms
Details:
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the Open vSwitch implementation in the Linux kernel
could overflow its stack during recursive action operations under certain
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-1151)
Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida
discovered that the Linux kernel mitigations for the initial Branch History
Injection vulnerability (CVE-2022-0001) were insufficient for Intel
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2024-2201)
Chenyuan Yang discovered that the RDS Protocol implementation in the Linux
kernel contained an out-of-bounds read vulnerability. An attacker could use
this to possibly cause a denial of service (system crash). (CVE-2024-23849)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- S390 architecture;
- Core kernel;
- Block layer subsystem;
- Android drivers;
- Power management core;
- Bus devices;
- Hardware random number generator core;
- Cryptographic API;
- Device frequency;
- DMA engine subsystem;
- ARM SCMI message protocol;
- GPU drivers;
- HID subsystem;
- Hardware monitoring drivers;
- I2C subsystem;
- IIO ADC drivers;
- IIO subsystem;
- IIO Magnetometer sensors drivers;
- InfiniBand drivers;
- Media drivers;
- Network drivers;
- PCI driver for MicroSemi Switchtec;
- PHY drivers;
- SCSI drivers;
- DesignWare USB3 driver;
- BTRFS file system;
- Ceph distributed file system;
- Ext4 file system;
- F2FS file system;
- JFS file system;
- NILFS2 file system;
- NTFS3 file system;
- Pstore file system;
- SMB network file system;
- Memory management;
- CAN network layer;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- Logical Link layer;
- MAC80211 subsystem;
- Multipath TCP;
- Netfilter;
- NFC subsystem;
- SMC sockets;
- Sun RPC protocol;
- TIPC protocol;
- Unix domain sockets;
- Tomoyo security module;
- Realtek audio codecs;
(CVE-2023-52616, CVE-2024-26679, CVE-2024-26608, CVE-2023-52594,
CVE-2024-26622, CVE-2023-52643, CVE-2024-26594, CVE-2023-52598,
CVE-2023-52627, CVE-2023-52491, CVE-2024-26592, CVE-2024-26717,
CVE-2023-52638, CVE-2024-26704, CVE-2023-52637, CVE-2024-26645,
CVE-2023-52602, CVE-2024-26722, CVE-2024-26671, CVE-2023-52599,
CVE-2024-26720, CVE-2023-52631, CVE-2023-52486, CVE-2024-26640,
CVE-2023-52606, CVE-2023-52633, CVE-2024-26593, CVE-2024-26664,
CVE-2023-52618, CVE-2024-26625, CVE-2023-52604, CVE-2024-26695,
CVE-2024-26644, CVE-2024-26826, CVE-2024-26600, CVE-2024-26808,
CVE-2023-52619, CVE-2023-52597, CVE-2024-26602, CVE-2024-26635,
CVE-2023-52623, CVE-2024-26665, CVE-2024-26916, CVE-2024-26689,
CVE-2023-52635, CVE-2024-26712, CVE-2023-52614, CVE-2024-26606,
CVE-2024-26610, CVE-2024-26675, CVE-2023-52617, CVE-2024-26697,
CVE-2023-52595, CVE-2023-52494, CVE-2024-26641, CVE-2024-26698,
CVE-2024-26707, CVE-2024-26673, CVE-2023-52493, CVE-2024-26676,
CVE-2024-26910, CVE-2023-52601, CVE-2024-26660, CVE-2023-52608,
CVE-2024-26615, CVE-2023-52587, CVE-2024-26825, CVE-2023-52498,
CVE-2023-52492, CVE-2024-26668, CVE-2024-26715, CVE-2024-26685,
CVE-2024-26702, CVE-2024-26663, CVE-2024-26636, CVE-2024-26627,
CVE-2024-26696, CVE-2023-52583, CVE-2023-52642, CVE-2023-52489,
CVE-2024-26614, CVE-2024-26829, CVE-2024-26684, CVE-2023-52615,
CVE-2023-52435, CVE-2023-52530, CVE-2023-52607, CVE-2024-26920,
CVE-2023-52622, CVE-2023-52588)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
linux-image-5.15.0-1057-intel-iotg 5.15.0-1057.63
linux-image-intel-iotg 5.15.0.1057.57
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6795-1
CVE-2023-47233, CVE-2023-52435, CVE-2023-52486, CVE-2023-52489,
CVE-2023-52491, CVE-2023-52492, CVE-2023-52493, CVE-2023-52494,
CVE-2023-52498, CVE-2023-52530, CVE-2023-52583, CVE-2023-52587,
CVE-2023-52588, CVE-2023-52594, CVE-2023-52595, CVE-2023-52597,
CVE-2023-52598, CVE-2023-52599, CVE-2023-52601, CVE-2023-52602,
CVE-2023-52604, CVE-2023-52606, CVE-2023-52607, CVE-2023-52608,
CVE-2023-52614, CVE-2023-52615, CVE-2023-52616, CVE-2023-52617,
CVE-2023-52618, CVE-2023-52619, CVE-2023-52622, CVE-2023-52623,
CVE-2023-52627, CVE-2023-52631, CVE-2023-52633, CVE-2023-52635,
CVE-2023-52637, CVE-2023-52638, CVE-2023-52642, CVE-2023-52643,
CVE-2024-1151, CVE-2024-2201, CVE-2024-23849, CVE-2024-26592,
CVE-2024-26593, CVE-2024-26594, CVE-2024-26600, CVE-2024-26602,
CVE-2024-26606, CVE-2024-26608, CVE-2024-26610, CVE-2024-26614,
CVE-2024-26615, CVE-2024-26622, CVE-2024-26625, CVE-2024-26627,
CVE-2024-26635, CVE-2024-26636, CVE-2024-26640, CVE-2024-26641,
CVE-2024-26644, CVE-2024-26645, CVE-2024-26660, CVE-2024-26663,
CVE-2024-26664, CVE-2024-26665, CVE-2024-26668, CVE-2024-26671,
CVE-2024-26673, CVE-2024-26675, CVE-2024-26676, CVE-2024-26679,
CVE-2024-26684, CVE-2024-26685, CVE-2024-26689, CVE-2024-26695,
CVE-2024-26696, CVE-2024-26697, CVE-2024-26698, CVE-2024-26702,
CVE-2024-26704, CVE-2024-26707, CVE-2024-26712, CVE-2024-26715,
CVE-2024-26717, CVE-2024-26720, CVE-2024-26722, CVE-2024-26808,
CVE-2024-26825, CVE-2024-26826, CVE-2024-26829, CVE-2024-26910,
CVE-2024-26916, CVE-2024-26920
Package Information:
https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1057.63
[USN-6792-1] Flask-Security vulnerability
==========================================================================
Ubuntu Security Notice USN-6792-1
May 28, 2024
flask-security vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Flask-Security could be made to bypass URL validation and redirect to
arbitary URL.
Software Description:
- flask-security: Simple security for Flask apps (Python 3)
Details:
Naom Moshe discovered that Flask-Security incorrectly validated URLs. An
attacker could use this issue to redirect users to arbitrary URLs.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
python3-flask-security 4.0.0-1ubuntu0.1
Ubuntu 20.04 LTS
python3-flask-security 1.7.5-2ubuntu0.20.04.1
Ubuntu 18.04 LTS
python3-flask-security 1.7.5-2ubuntu0.18.04.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6792-1
( https://ubuntu.com/security/notices/USN-6792-1)
CVE-2021-23385
Package Information:
https://launchpad.net/ubuntu/+source/flask-security/4.0.0-1ubuntu0.1
( https://launchpad.net/ubuntu/+source/flask-security/4.0.0-1ubuntu0.1)
https://launchpad.net/ubuntu/+source/flask-security/1.7.5-2ubuntu0.20.04.1
( https://launchpad.net/ubuntu/+source/flask-security/1.7.5-2ubuntu0.20.04.1)
[USN-6794-1] FRR vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6794-1
May 28, 2024
frr vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in FRR.
Software Description:
- frr: FRRouting suite of internet protocols
Details:
It was discovered that FRR incorrectly handled certain malformed BGP and
OSPF packets. A remote attacker could use this issue to cause FRR to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
frr 8.4.4-1.1ubuntu6.1
Ubuntu 23.10
frr 8.4.4-1.1ubuntu1.4
Ubuntu 22.04 LTS
frr 8.1-1ubuntu1.10
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6794-1
CVE-2024-31948, CVE-2024-31950, CVE-2024-31951, CVE-2024-34088
Package Information:
https://launchpad.net/ubuntu/+source/frr/8.4.4-1.1ubuntu6.1
https://launchpad.net/ubuntu/+source/frr/8.4.4-1.1ubuntu1.4
https://launchpad.net/ubuntu/+source/frr/8.1-1ubuntu1.10
[USN-6793-1] Git vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6793-1
May 28, 2024
git vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Git.
Software Description:
- git: fast, scalable, distributed revision control system
Details:
It was discovered that Git incorrectly handled certain submodules.
An attacker could possibly use this issue to execute arbitrary code.
This issue was fixed in Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2024-32002)
It was discovered that Git incorrectly handled certain cloned repositories.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-32004)
It was discovered that Git incorrectly handled local clones with hardlinked
files/directories. An attacker could possibly use this issue to place a
specialized repository on their target's local system. (CVE-2024-32020)
It was discovered that Git incorrectly handled certain symlinks. An attacker
could possibly use this issue to impact availability and integrity
creating hardlinked arbitrary files into users repository's objects/directory.
(CVE-2024-32021)
It was discovered that Git incorrectly handled certain cloned repositories.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-32465)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
git 1:2.43.0-1ubuntu7.1
Ubuntu 23.10
git 1:2.40.1-1ubuntu1.1
Ubuntu 22.04 LTS
git 1:2.34.1-1ubuntu1.11
Ubuntu 20.04 LTS
git 1:2.25.1-1ubuntu3.12
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6793-1
CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021,
CVE-2024-32465
Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.43.0-1ubuntu7.1
https://launchpad.net/ubuntu/+source/git/1:2.40.1-1ubuntu1.1
https://launchpad.net/ubuntu/+source/git/1:2.34.1-1ubuntu1.11
https://launchpad.net/ubuntu/+source/git/1:2.25.1-1ubuntu3.12
