Ubuntu update for linux-kvm



| Updated: 2024-05-13
Risk Medium
Patch available YES
Number of vulnerabilities 17
CVE-ID CVE-2022-3169
CVE-2022-3344
CVE-2022-3435
CVE-2022-3521
CVE-2022-3545
CVE-2022-4139
CVE-2022-42328
CVE-2022-42329
CVE-2022-4379
CVE-2022-45869
CVE-2022-47518
CVE-2022-47519
CVE-2022-47520
CVE-2022-47521
CVE-2023-0179
CVE-2023-0461
CVE-2023-0468
CWE-ID CWE-399
CWE-440
CWE-125
CWE-362
CWE-119
CWE-416
CWE-787
CWE-190
CWE-476
Exploitation vector Network
Public exploit Public exploit code for vulnerability #15 is available.
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

linux-image-5.15.0-1029-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 17 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU68780

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3169

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in Linux kernel when handling a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver. A local user can force the a PCIe link to disconnect.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Expected behavior violation

EUVDB-ID: #VU71582

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-3344

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in the KVM's AMD nested virtualization (SVM). A malicious L1 guest can purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0).

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU70499

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-3435

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the fib_nh_match() function in net/ipv4/fib_semantics.c IPv4 handler. A remote attacker can send specially crafted data to the system, trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Race condition

EUVDB-ID: #VU69755

Risk: Low

CVSSv4.0: 4.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3521

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the kcm_tx_work() function in net/kcm/kcmsock.c in Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU69758

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3545

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the area_cache_get() function in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU70460

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-4139

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the i915 kernel driver on Linux kernel. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.


Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource management error

EUVDB-ID: #VU70469

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Green]

CVE-ID: CVE-2022-42328

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource management error

EUVDB-ID: #VU70470

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Green]

CVE-ID: CVE-2022-42329

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU71583

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-4379

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the __nfs42_ssc_open() function in fs/nfs/nfs4file.c. A remote attacker can perform a denial of service (DoS) attack.


Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Race condition

EUVDB-ID: #VU70502

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-45869

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a race condition within the x86 KVM subsystem in the Linux kernel when nested virtualisation and the TDP MMU are enabled. A remote  user on the guest OS can exploit the race and crash the host OS.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds write

EUVDB-ID: #VU70625

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-47518

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing a number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver. A local user can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds write

EUVDB-ID: #VU70626

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-47519

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver. A local user can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU70627

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-47520

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver.  A local user can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds write

EUVDB-ID: #VU70628

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-47521

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver. A local user trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Integer overflow

EUVDB-ID: #VU71173

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-0179

CWE-ID: CWE-190 - Integer overflow

Exploit availability: Yes

Description

The vulnerability allows a local  user to escalate privileges on the system.

The vulnerability exists due to an integer overflow within the nft_payload_copy_vlan() function in Linux kernel Netfilter. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

16) Use-after-free

EUVDB-ID: #VU72506

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0461

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Upper Level Protocol (ULP) subsystem in Linux kernel caused by improper handling of sockets entering the LISTEN state in certain protocols. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.


Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) NULL pointer dereference

EUVDB-ID: #VU72343

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0468

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the io_poll_check_events() function in io_uring/poll.c within the io_uring subcomponent in the Linux Kernel. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-kvm to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-5.15.0-1029-kvm (Ubuntu package): before 5.15.0-1029.34

linux-image-kvm (Ubuntu package): before 5.15.0.1029.25

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5941-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###