USN-7009-2

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-7009-2
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7009-2.json
JSON Data
https://api.test.osv.dev/v1/vulns/USN-7009-2
Upstream
Related
Published
2024-09-25T08:27:37Z
Modified
2026-08-06T03:07:47Z
Summary
linux-azure-fde-5.15 vulnerabilities
Details

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

  • ARM64 architecture;
  • M68K architecture;
  • MIPS architecture;
  • PowerPC architecture;
  • RISC-V architecture;
  • x86 architecture;
  • Block layer subsystem;
  • Cryptographic API;
  • Accessibility subsystem;
  • ACPI drivers;
  • Serial ATA and Parallel ATA drivers;
  • Drivers core;
  • Bluetooth drivers;
  • Character device driver;
  • CPU frequency scaling framework;
  • Hardware crypto device drivers;
  • Buffer Sharing and Synchronization framework;
  • DMA engine subsystem;
  • FPGA Framework;
  • GPIO subsystem;
  • GPU drivers;
  • Greybus drivers;
  • HID subsystem;
  • HW tracing;
  • I2C subsystem;
  • IIO subsystem;
  • InfiniBand drivers;
  • Input Device (Mouse) drivers;
  • Macintosh device drivers;
  • Multiple devices driver;
  • Media drivers;
  • VMware VMCI Driver;
  • Network drivers;
  • Near Field Communication (NFC) drivers;
  • NVME drivers;
  • Pin controllers subsystem;
  • PTP clock framework;
  • S/390 drivers;
  • SCSI drivers;
  • SoundWire subsystem;
  • Greybus lights staging drivers;
  • Media staging drivers;
  • Thermal drivers;
  • TTY drivers;
  • USB subsystem;
  • DesignWare USB3 driver;
  • Framebuffer layer;
  • ACRN Hypervisor Service Module driver;
  • eCrypt file system;
  • File systems infrastructure;
  • Ext4 file system;
  • F2FS file system;
  • JFFS2 file system;
  • JFS file system;
  • NILFS2 file system;
  • NTFS3 file system;
  • SMB network file system;
  • IOMMU subsystem;
  • Memory management;
  • Netfilter;
  • BPF subsystem;
  • Kernel debugger infrastructure;
  • DMA mapping infrastructure;
  • IRQ subsystem;
  • Tracing infrastructure;
  • 9P file system network protocol;
  • B.A.T.M.A.N. meshing protocol;
  • CAN network layer;
  • Ceph Core library;
  • Networking core;
  • IPv4 networking;
  • IPv6 networking;
  • IUCV driver;
  • MAC80211 subsystem;
  • Multipath TCP;
  • NET/ROM layer;
  • NFC subsystem;
  • Open vSwitch;
  • Network traffic control;
  • TIPC protocol;
  • TLS protocol;
  • Unix domain sockets;
  • Wireless networking;
  • XFRM subsystem;
  • ALSA framework;
  • SoC Audio for Freescale CPUs drivers;
  • Kirkwood ASoC drivers; (CVE-2024-42076, CVE-2024-40994, CVE-2024-40932, CVE-2024-41000, CVE-2024-42224, CVE-2024-38633, CVE-2024-40954, CVE-2024-36270, CVE-2024-38623, CVE-2024-38549, CVE-2024-42225, CVE-2024-42085, CVE-2024-42157, CVE-2024-42229, CVE-2024-42109, CVE-2024-41040, CVE-2024-38607, CVE-2024-39493, CVE-2024-38546, CVE-2024-41046, CVE-2024-38567, CVE-2024-42092, CVE-2024-39501, CVE-2024-41005, CVE-2024-42223, CVE-2024-39480, CVE-2024-38571, CVE-2024-41048, CVE-2024-38605, CVE-2024-42094, CVE-2024-38598, CVE-2024-38559, CVE-2024-38558, CVE-2024-40931, CVE-2024-40942, CVE-2024-39495, CVE-2024-40981, CVE-2024-40911, CVE-2024-42148, CVE-2024-33621, CVE-2024-39502, CVE-2024-41095, CVE-2024-40960, CVE-2024-36286, CVE-2024-42232, CVE-2024-42130, CVE-2024-42154, CVE-2024-41087, CVE-2024-41004, CVE-2024-39277, CVE-2024-38560, CVE-2024-36978, CVE-2024-42089, CVE-2024-37356, CVE-2024-38547, CVE-2024-38381, CVE-2024-36015, CVE-2024-38548, CVE-2024-42120, CVE-2024-41092, CVE-2024-40978, CVE-2024-38619, CVE-2024-40914, CVE-2024-41089, CVE-2024-40988, CVE-2024-41047, CVE-2024-38565, CVE-2024-38550, CVE-2023-52887, CVE-2024-38552, CVE-2024-38583, CVE-2024-38613, CVE-2024-40967, CVE-2024-40927, CVE-2024-42124, CVE-2024-42244, CVE-2024-42152, CVE-2024-39509, CVE-2024-38662, CVE-2024-38618, CVE-2024-42140, CVE-2024-38579, CVE-2024-40945, CVE-2024-42101, CVE-2024-42104, CVE-2024-41044, CVE-2024-42161, CVE-2024-42093, CVE-2024-42270, CVE-2024-42097, CVE-2024-40970, CVE-2024-40908, CVE-2024-38582, CVE-2024-42247, CVE-2024-38661, CVE-2024-40941, CVE-2024-42084, CVE-2024-42090, CVE-2024-42131, CVE-2024-42077, CVE-2024-40995, CVE-2024-42105, CVE-2024-41035, CVE-2024-41097, CVE-2024-38780, CVE-2024-35247, CVE-2024-36974, CVE-2024-42070, CVE-2024-40902, CVE-2024-36972, CVE-2024-38586, CVE-2024-38573, CVE-2024-38612, CVE-2024-42121, CVE-2023-52884, CVE-2024-39276, CVE-2024-38615, CVE-2024-42095, CVE-2024-42086, CVE-2024-39507, CVE-2024-40983, CVE-2024-40943, CVE-2024-41002, CVE-2024-40958, CVE-2024-41049, CVE-2024-38596, CVE-2024-37078, CVE-2024-38637, CVE-2024-38621, CVE-2024-42153, CVE-2024-38659, CVE-2024-39468, CVE-2024-38589, CVE-2024-38587, CVE-2024-36971, CVE-2024-38599, CVE-2024-31076, CVE-2024-39490, CVE-2024-40959, CVE-2024-38634, CVE-2024-38624, CVE-2024-42240, CVE-2024-42127, CVE-2024-42102, CVE-2024-38578, CVE-2024-34027, CVE-2024-38601, CVE-2024-42087, CVE-2024-38597, CVE-2024-38591, CVE-2024-39503, CVE-2024-42236, CVE-2024-42082, CVE-2024-40956, CVE-2024-41041, CVE-2024-38580, CVE-2024-39506, CVE-2024-36894, CVE-2024-40987, CVE-2024-39475, CVE-2024-38635, CVE-2024-41007, CVE-2024-39471, CVE-2024-39467, CVE-2022-48772, CVE-2024-40934, CVE-2024-42106, CVE-2024-39469, CVE-2024-40963, CVE-2024-39482, CVE-2024-39505, CVE-2024-36014, CVE-2024-39500, CVE-2024-42096, CVE-2024-41055, CVE-2024-40937, CVE-2024-38590, CVE-2024-38610, CVE-2024-41034, CVE-2024-42115, CVE-2024-40974, CVE-2024-40968, CVE-2024-42080, CVE-2024-40957, CVE-2024-40971, CVE-2024-36032, CVE-2024-39499, CVE-2024-42137, CVE-2024-39489, CVE-2024-40976, CVE-2024-39466, CVE-2024-42145, CVE-2024-36489, CVE-2024-40980, CVE-2024-39301, CVE-2024-40905, CVE-2024-41093, CVE-2024-40912, CVE-2024-42119, CVE-2024-38588, CVE-2024-40916, CVE-2024-39488, CVE-2024-41027, CVE-2024-42068, CVE-2024-40904, CVE-2024-40961, CVE-2024-33847, CVE-2024-38555, CVE-2024-41006, CVE-2024-40929, CVE-2024-34777, CVE-2024-38627, CVE-2024-40984, CVE-2024-40990, CVE-2024-39487, CVE-2024-42098, CVE-2024-40901)
References

Affected packages

Ubuntu:20.04:LTS / linux-azure-fde-5.15

Package

Name
linux-azure-fde-5.15
Purl
pkg:deb/ubuntu/linux-azure-fde-5.15?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.15.0-1072.81~20.04.1.1

Affected versions

5.*
5.15.0-1019.24~20.04.1.1
5.15.0-1020.25~20.04.1.1
5.15.0-1021.26~20.04.1.1
5.15.0-1029.36~20.04.1.1
5.15.0-1030.37~20.04.1.1
5.15.0-1031.38~20.04.1.1
5.15.0-1033.40~20.04.1.1
5.15.0-1034.41~20.04.1.2
5.15.0-1035.42~20.04.1.1
5.15.0-1036.43~20.04.1.1
5.15.0-1037.44~20.04.1.1
5.15.0-1038.45~20.04.1.1
5.15.0-1039.46~20.04.1.1
5.15.0-1040.47~20.04.1.1
5.15.0-1041.48~20.04.1.1
5.15.0-1042.49~20.04.1.1
5.15.0-1043.50~20.04.1.1
5.15.0-1046.53~20.04.1.1
5.15.0-1047.54~20.04.1.1
5.15.0-1049.56~20.04.1.1
5.15.0-1050.57~20.04.1.1
5.15.0-1051.59~20.04.1.1
5.15.0-1052.60~20.04.1.1
5.15.0-1053.61~20.04.1.1
5.15.0-1054.62~20.04.1.1
5.15.0-1056.64~20.04.1.1
5.15.0-1057.65~20.04.1.1
5.15.0-1058.66~20.04.2.1
5.15.0-1059.67~20.04.1.1
5.15.0-1060.69~20.04.1.1
5.15.0-1061.70~20.04.1.1
5.15.0-1063.72~20.04.1.1
5.15.0-1064.73~20.04.1.1
5.15.0-1065.74~20.04.1.1
5.15.0-1067.76~20.04.1.1
5.15.0-1068.77~20.04.1.1
5.15.0-1070.79~20.04.1.1
5.15.0-1071.80~20.04.1.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "linux-image-unsigned-5.15.0-1072-azure-fde",
            "binary_version": "5.15.0-1072.81~20.04.1.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2024-36972",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "high",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-38381",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-38587",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-39475",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-39493",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-39501",
            "severity": [
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-39503",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-40934",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-41049",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2024-41055",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7009-2.json"