Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 510
Alerts This Week
Warning Icon 1 510

Ubuntu 20.04 LTS USN-5706-1 Critical: Multiple Kernel Issues

ubuntu
Calendar Grey October 27, 2022
Dist Ubuntu Esm H88
Multiple security flaws in Ubuntu's Linux kernel patched; urgent updates released for Azure Cloud VM instances.
Several security issues were fixed in the Linux kernel.

Summary

Several security issues were fixed in the Linux kernel.

Software Description:

- linux-azure-fde: Linux kernel for Microsoft Azure CVM cloud systems

Details:

It was discovered that the BPF verifier in the Linux kernel did not

properly handle internal data structures. A local attacker could use this

to expose sensitive information (kernel memory). (CVE-2021-4159)

It was discovered that an out-of-bounds write vulnerability existed in the

Video for Linux 2 (V4L2) implementation in the Linux kernel. A local

attacker could use this to cause a denial of service (system crash) or

possibly execute arbitrary code. (CVE-2022-20369)

Duoming Zhou discovered that race conditions existed in the timer handling

implementation of the Linux kernel's Rose X.25 protocol layer, resulting in

use-after-free vulnerabilities. A local attacker could use this to cause a

denial of service (system crash). (CVE-2022-2318)

Roger Pau Monné discovered that the Xen virtual block driver i...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical Ubuntu kernel information exposure Denial of Service Linux

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
   linux-image-5.4.0-1092-azure-fde  5.4.0-1092.97+cvm1.1
   linux-image-azure-fde           5.4.0.1092.97+cvm1.32

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

https://ubuntu.com/security/notices/USN-5706-1

CVE-2021-4159, CVE-2022-20369, CVE-2022-2318, CVE-2022-26365,

CVE-2022-26373, CVE-2022-3176, CVE-2022-33740, CVE-2022-33741,

CVE-2022-33742, CVE-2022-33744, CVE-2022-36879

Severity
critical
Lowest
Low
Medium
High
Critical

October 27, 2022

Topics%20covered

Topics Covered

security advisory critical Ubuntu kernel information exposure Denial of Service Linux

Package Information

https://launchpad.net/ubuntu/+source/linux-azure-fde/5.4.0-1092.97+cvm1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.