[USN-6922-2] Linux kernel vulnerabilities
[USN-6941-1] Python vulnerability
[USN-6940-1] snapd vulnerabilities
[USN-6922-2] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6922-2
August 01, 2024
linux-lowlatency-hwe-6.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lowlatency-hwe-6.5: Linux low latency kernel
Details:
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)
Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device
volume management subsystem did not properly validate logical eraseblock
sizes in certain situations. An attacker could possibly use this to cause a
denial of service (system crash). (CVE-2024-25739)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
linux-image-6.5.0-45-lowlatency 6.5.0-45.45.1~22.04.1
linux-image-6.5.0-45-lowlatency-64k 6.5.0-45.45.1~22.04.1
linux-image-lowlatency-64k-hwe-22.04 6.5.0.45.45.1~22.04.1
linux-image-lowlatency-hwe-22.04 6.5.0.45.45.1~22.04.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6922-2
https://ubuntu.com/security/notices/USN-6922-1
CVE-2024-24857, CVE-2024-24858, CVE-2024-24859, CVE-2024-25739
Package Information:
https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-6.5/6.5.0-45.45.1~22.04.1
[USN-6941-1] Python vulnerability
==========================================================================
Ubuntu Security Notice USN-6941-1
August 01, 2024
python3.12 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
Summary:
Python could allow unintended access to network services.
Software Description:
- python3.12: An interactive high-level object-oriented language
Details:
It was discovered that the Python ipaddress module contained incorrect
information about which IP address ranges were considered “private” or
“globally reachable”. This could possibly result in applications applying
incorrect security policies.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
python3.12 3.12.3-1ubuntu0.1
python3.12-minimal 3.12.3-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6941-1
CVE-2024-4032
Package Information:
https://launchpad.net/ubuntu/+source/python3.12/3.12.3-1ubuntu0.1
[USN-6940-1] snapd vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6940-1
August 01, 2024
snapd vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in snapd.
Software Description:
- snapd: Daemon and tooling that enable snap packages
Details:
Neil McPhail discovered that snapd did not properly restrict writes to the
$HOME/bin path in the AppArmor profile for snaps using the home plug. An
attacker who could convince a user to install a malicious snap could use this
vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type when
extracting a snap. An attacker who could convince a user to install a malicious
snap containing non-regular files could then cause snapd to block indefinitely
while trying to read from such files and cause a denial of
service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the destination of
symbolic links when extracting a snap. An attacker who could convince a user to
install a malicious snap containing crafted symbolic links could then cause
snapd to write out the contents of the symbolic link destination into a
world-readable directory. This in-turn could allow a local unprivileged user to
gain access to privileged information. (CVE-2024-29069)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
snapd 2.63+24.04ubuntu0.1
Ubuntu 22.04 LTS
snapd 2.63+22.04ubuntu0.1
Ubuntu 20.04 LTS
snapd 2.63+20.04ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6940-1
CVE-2024-1724, CVE-2024-29068, CVE-2024-29069
Package Information:
https://launchpad.net/ubuntu/+source/snapd/2.63+24.04ubuntu0.1
https://launchpad.net/ubuntu/+source/snapd/2.63+22.04ubuntu0.1
https://launchpad.net/ubuntu/+source/snapd/2.63+20.04ubuntu0.1
