Linux kernel vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 22.04 LTS

Packages

• linux - Linux kernel
• linux-aws - Linux kernel for Amazon Web Services (AWS) systems
• linux-aws-6.2 - Linux kernel for Amazon Web Services (AWS) systems
• linux-azure - Linux kernel for Microsoft Azure Cloud systems
• linux-azure-6.2 - Linux kernel for Microsoft Azure cloud systems
• linux-azure-fde-6.2 - Linux kernel for Microsoft Azure CVM cloud systems
• linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
• linux-hwe-6.5 - Linux hardware enablement (HWE) kernel
• linux-laptop - Linux kernel for Lenovo X13s ARM laptops
• linux-lowlatency - Linux low latency kernel
• linux-lowlatency-hwe-6.5 - Linux low latency kernel
• linux-oem-6.5 - Linux kernel for OEM systems
• linux-oracle - Linux kernel for Oracle Cloud systems
• linux-raspi - Linux kernel for Raspberry Pi systems
• linux-starfive - Linux kernel for StarFive processors

Details

It was discovered that the CIFS network file system implementation in the
Linux kernel did not properly validate the server frame size in certain
situation, leading to an out-of-bounds read vulnerability. An attacker
could use this to construct a malicious CIFS image that, when operated on,
could cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-6606)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did
not properly handle inactive elements in its PIPAPO data structure, leading
to a use-after-free vulnerability. A local attacker could use this to cause
a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2023-6817)

Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf
subsystem in the Linux kernel did not properly validate all event sizes
when attaching new events, leading to an out-of-bounds write vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6931)

It was discovered that the IGMP protocol implementation in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6932)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly check deactivated elements in certain situations, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2024-0193)