USN-5913-1
- Source
- https://ubuntu.com/security/notices/USN-5913-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5913-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-5913-1
- Related
- Published
- 2023-03-03T00:28:16.624135Z
- Modified
- 2023-03-03T00:28:16.624135Z
- Summary
- linux-oem-5.14, linux-oem-5.17 vulnerabilities
- Details
-
It was discovered that the Upper Level Protocol (ULP) subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-0461)
Lee Jones discovered that a use-after-free vulnerability existed in the Bluetooth implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20566)
It was discovered that the ISDN implementation of the Linux kernel contained a use-after-free vulnerability. A privileged user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3565)
It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a reference counting error. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36879)
It was discovered that the USB monitoring (usbmon) component in the Linux kernel did not properly set permissions on memory mapped in to user space processes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-43750)
It was discovered that the NFSD implementation in the Linux kernel contained a use-after-free vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-4379)
It was discovered that the Atmel WILC1000 driver in the Linux kernel did not properly validate offsets, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2022-47520)
José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)
- References
-
- https://ubuntu.com/security/notices/USN-5913-1
- https://ubuntu.com/security/CVE-2022-3565
- https://ubuntu.com/security/CVE-2022-4379
- https://ubuntu.com/security/CVE-2022-20566
- https://ubuntu.com/security/CVE-2022-36879
- https://ubuntu.com/security/CVE-2022-43750
- https://ubuntu.com/security/CVE-2022-47520
- https://ubuntu.com/security/CVE-2023-0045
- https://ubuntu.com/security/CVE-2023-0461
Affected packages
Ubuntu:20.04:LTS / linux-oem-5.14
Package
- Name
- linux-oem-5.14
- Purl
- pkg:deb/ubuntu/linux-oem-5.14?arch=src?distro=focal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.14.0-1058.66
Affected versions
5.*
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-buildinfo-5.14.0-1058-oem"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-headers-5.14.0-1058-oem"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-image-unsigned-5.14.0-1058-oem"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-image-unsigned-5.14.0-1058-oem-dbgsym"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-modules-5.14.0-1058-oem"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-modules-iwlwifi-5.14.0-1058-oem"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-oem-5.14-headers-5.14.0-1058"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-oem-5.14-tools-5.14.0-1058"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-oem-5.14-tools-host"
},
{
"binary_version": "5.14.0-1058.66",
"binary_name": "linux-tools-5.14.0-1058-oem"
}
]
}
Ubuntu:22.04:LTS / linux-oem-5.17
Package
- Name
- linux-oem-5.17
- Purl
- pkg:deb/ubuntu/linux-oem-5.17?arch=src?distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.17.0-1028.29
Affected versions
5.*
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-buildinfo-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-headers-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-image-unsigned-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-image-unsigned-5.17.0-1028-oem-dbgsym"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-modules-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-modules-ipu6-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-modules-ivsc-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-modules-iwlwifi-5.17.0-1028-oem"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-oem-5.17-headers-5.17.0-1028"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-oem-5.17-tools-5.17.0-1028"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-oem-5.17-tools-host"
},
{
"binary_version": "5.17.0-1028.29",
"binary_name": "linux-tools-5.17.0-1028-oem"
}
]
}