Fellow Linux admins-

If you're running Ubuntu versions 23.10 and 24.04, three new security bypasses threatening Ubuntu Linux's control over unprivileged user namespaces are putting your kernel and your systems at risk of unauthorized access. Attackers could use these stealthy loopholes to gain administrative-like capabilities in user namespaces and exploit kernel components.

 

Read on to learn more about these sneaky bugs and measures you can take to ensure that your kernel—the heart of your Ubuntu systems—remains secure!

You'll also learn about a Use After Free (UAF) condition discovered in the key_put() function of the kernel's key management system that could allow an attacker to exploit freed memory, leading to unpredictable behavior or even the execution of malicious code. 

If you found value in today’s newsletter, please share it with your friends! Do you have a Linux security-related topic you'd like to cover for our audience? We welcome contributions from passionate, insightful community members who share our love for Linux and security!

Yours in Open Source, 

Dv Signature Newsletter 2024 Esm W150

Dave Wreski

LinuxSecurity Founder

Linux Kernel 

The Discovery 

Three security bypasses targeting Ubuntu versions 23.10 and 24.04 have been discovered. These issues threaten Ubuntu Linux's control over unprivileged user namespaces.

Ubuntu Esm W225

The Impact

These bypasses could allow local unprivileged users to gain administrative-like capabilities in user namespaces and exploit kernel components. 

 The Fix

Linux kernel security updates have been released to mitigate these bugs. All impacted users should immediately apply these updates to secure their kernel and critical Linux systems. 

Your Related Advisories:

[distro_list_1]

Linux Kernel 

The Discovery 

A Use After Free (UAF) condition was discovered in the key_put() function of the kernel's key management system.

LinuxKernel Esm W206

The Impact

This vulnerability could allow an attacker to exploit freed memory, leading to unpredictable behavior or even the execution of malicious code. 

 The Fix

This issue has been fixed in Linux kernel 6.14. All admins and users should upgrade to the latest kernel version as soon as possible to mitigate the risk posed by this flaw and benefit from the other enhancements this release offers. 

Your Related Advisories:

[distro_list_2]