USN-5884-1
See a problem?- Source
- https://ubuntu.com/security/notices/USN-5884-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5884-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-5884-1
- Related
- Published
- 2023-02-23T16:09:52.810737Z
- Modified
- 2023-02-23T16:09:52.810737Z
- Summary
- linux-aws vulnerabilities
- Details
-
Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)
Lee Jones discovered that a use-after-free vulnerability existed in the Bluetooth implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20566)
Duoming Zhou discovered that a race condition existed in the SLIP driver in the Linux kernel, leading to a null pointer dereference vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2022-41858)
Tamás Koczka discovered that the Bluetooth L2CAP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-42895)
José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)
It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)
- References
-
- https://ubuntu.com/security/notices/USN-5884-1
- https://ubuntu.com/security/CVE-2021-4155
- https://ubuntu.com/security/CVE-2022-20566
- https://ubuntu.com/security/CVE-2022-41858
- https://ubuntu.com/security/CVE-2022-42895
- https://ubuntu.com/security/CVE-2023-0045
- https://ubuntu.com/security/CVE-2023-23559
Affected packages
Ubuntu:Pro:16.04:LTS / linux-aws
Package
- Name
- linux-aws
- Purl
- pkg:deb/ubuntu/linux-aws@4.4.0-1154.169?arch=src?distro=esm-infra/xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.4.0-1154.169
Affected versions
4.*
Ecosystem specific
{
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"linux-headers-4.4.0-1154-aws": "4.4.0-1154.169",
"linux-aws-tools-4.4.0-1154": "4.4.0-1154.169",
"linux-cloud-tools-4.4.0-1154-aws": "4.4.0-1154.169",
"linux-tools-4.4.0-1154-aws": "4.4.0-1154.169",
"linux-buildinfo-4.4.0-1154-aws": "4.4.0-1154.169",
"linux-aws-cloud-tools-4.4.0-1154": "4.4.0-1154.169",
"linux-image-4.4.0-1154-aws-dbgsym": "4.4.0-1154.169",
"linux-modules-extra-4.4.0-1154-aws": "4.4.0-1154.169",
"linux-aws-headers-4.4.0-1154": "4.4.0-1154.169",
"linux-image-4.4.0-1154-aws": "4.4.0-1154.169",
"linux-modules-4.4.0-1154-aws": "4.4.0-1154.169"
}
]
}