USN-6465-3: Linux kernel (GKE) vulnerabilities

Yu Hao and Weiteng Chen discovered that the Bluetooth HCI UART driver in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service system crash. CVE-2023-31083 Lin Ma discovered that the Netlink...

Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6465-3)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6465-3 advisory. Yu Hao and Weiteng Chen discovered that the Bluetooth HCI UART driver in the Linux kernel contained a race condition, leading to a null pointer dereferen...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: memcached-exporter, kubeflow-fips, atlantis, minio, terraform-provider-sendgrid, kubernetes-dns-node-cache, flux-image-reflector-controller, tkn, aactl, prometheus-adapter-fips, prometheus-elasticsearch-exporter, zot, kube-logging-operator, cosign, gitness, pulumi,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: memcached-exporter, kubeflow-fips, atlantis, minio, ip-masq-agent, terraform-provider-sendgrid, nghttp2, aactl, prometheus-adapter-fips, prometheus-elasticsearch-exporter, envoy-ratelimit, cosign, gitness, pulumi, kube-state-metrics, flux-kustomize-controller, kaf,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, memcached-exporter, grype, terraform-provider-azurerm, frp, metacontroller, gke-gcloud-auth-plugin, kots, nats, wireguard-go, certificate-transparency, nghttp2, envoy-ratelimit, cortex, pulumi-language-java, ko, nginx-mainline, ollama,...

Ubuntu: Security Advisory (USN-6351-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6351-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6351-1 advisory. It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker cou...

USN-6351-1: Linux kernel (GKE) vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service system crash. CVE-2022-48425...

USN-6324-1: Linux kernel (GKE) vulnerabilities

Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. CVE-2022-40982 Tavis Ormandy discovered that some AMD processors...

Ubuntu 20.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6324-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6324-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions...

Ubuntu: Security Advisory (USN-6311-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6312-1: Linux kernel vulnerabilities

It was discovered that the netlink implementation in the Linux kernel did not properly validate policies when parsing attributes in some situations. An attacker could use this to cause a denial of service infinite recursion. CVE-2020-36691 Billy Jheng Bing Jhong discovered that the CIFS network...

Ubuntu 20.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6205-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6205-1 advisory. Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of- bounds write vulnerability. An attacker could use this to...

Ubuntu: Security Advisory (USN-6205-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6205-1: Linux kernel (GKE) vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 It was discovered that for some...

USN-6193-1: Linux kernel vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 It was discovered that for some...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (GKE) regression (USN-6152-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6152-1 advisory. It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions...

USN-6152-1: Linux kernel (GKE) regression

It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions. This updated makes the NFS file-access stale cache behavior to be optional...

This Week in Spring - June 6th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what an insane week it's been! Long story short, I've spent 10-12 hours a day over the last five days migrating a dozen differnet applications and services from one GKE cluster to another, taking the time to update things...

Use Of Uninitialized Variable

linux-gke is vulnerable to Use of Uninitialized Variable. The vulnerability allows users with the ability to execute high-privileged code to exploit the flaws within 'nftosfeval function' causing a lack of proper initialization of memory prior to accessing it resulting in the attacker gaining...