Critical Advisory: Linux Kernel, GNU C Library & WebKitGTK Updates for 2022

Mar 11, 2022 •

2 - 3 min read

Happy Friday fellow Linux geeks! This week, important updates have been issued for the Linux Kernel, GNU C Library and WebKitGTK. Read on to learn about these vulnerabilities and how to secure your system against them.

Now you can personalize your LinuxSecurity.com User Profile to include the latest advisories for the distros you select, making it easier than ever to keep your system up-to-date and secure.

Have a question about or comment on one of the vulnerabilities highlighted in today's newsletter? Let's discuss!

Yours in Open Source,

Brittany Signature 150 Esm W150

Linux Kernel

The Discovery

Multiple security issues have been discovered in the Linux kernel, one of which has been deemed the most high-severity Linux security vulnerability in years. CVE-2022-0847, which has been named Dirty Pipe, is a bug in the kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is O_RDONLY, immutable or on a MS_RDONLY filesystem.

The Impact

Dirty Pipe could be exploited to inject code into arbitrary processes, enabling an attacker to install backdoors, create unauthorized user accounts, and modify scripts or binaries used by privileged services or apps. The other flaws that have been identified (CVE-2022-25258 and CVE-2022-25375) could result in memory corruption or information leakage.

The Fix

An important kernel security update mitigates Dirty Pipe and the other bugs that have been found in the kernel. Patch now!

Your Related Advisories:

[distro_list_1]

GNU C Library

The Discovery

Several security issues were found in GNU C Library (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2020-6096, CVE-2021-27645, CVE-2021-3326, CVE-2021-35942, CVE-2021-3998, CVE-2021-3999, CVE-2022-23218 and CVE-2022-23219).
GNUCLibrary Esm W275

The Impact

Exploitation of these vulnerabilities could result in denial of service (DoS), the execution of arbitrary code, or information leakage.

The Fix

These flaws in GNU C Library have now been fixed. Update promptly to protect sensitive information and the security, integrity and availability of your systems.

Your Related Advisories:

[distro_list_2]

WebKitGTK

The Discovery

Several remotely-exploitable security issues were discovered in the WebKitGTK Web and JavaScript engines (CVE-2022-22589, CVE-2022-22590 and CVE-2022-22592).

The Impact

If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting (XSS) attacks, denial of service (DoS) attacks and arbitrary code execution.