Ubuntu update for linux-snapdragon

Published: 2023-04-19 | Updated: 2024-10-17

Risk	High
Patch available	YES
Number of vulnerabilities	16
CVE-ID	CVE-2021-3669 CVE-2022-3424 CVE-2022-36280 CVE-2022-3903 CVE-2022-41218 CVE-2022-47929 CVE-2023-0045 CVE-2023-0266 CVE-2023-0394 CVE-2023-1073 CVE-2023-1074 CVE-2023-1281 CVE-2023-23455 CVE-2023-23559 CVE-2023-26545 CVE-2023-28328
CWE-ID	CWE-400 CWE-416 CWE-787 CWE-399 CWE-476 CWE-254 CWE-119 CWE-401 CWE-843 CWE-190 CWE-415
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #5 is available. Public exploit code for vulnerability #7 is available. Vulnerability #8 is being exploited in the wild.
Vulnerable software	Ubuntu Operating systems & Components / Operating system linux-image-snapdragon (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-4.15.0-1148-snapdragon (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 16 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU63911

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3669

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to measuring usage of the shared memory does not scale with large shared memory segment counts. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU69759

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3424

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the gru_set_context_option(), gru_fault() and gru_handle_user_call_os() functions in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU71480

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36280

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the vmw_kms_cursor_snoo() function in drivers/gpu/vmxgfx/vmxgfx_kms.c in vmwgfx VMWare driver. A local user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource management error

EUVDB-ID: #VU70465

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3903

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an incorrect read request flaw in the Infrared Transceiver USB driver in Linux kernel. An attacker with physical access to the system can starve system resources and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU67657

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2022-41218

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dvb_demux_open() and dvb_dmxdev_release() function in drivers/media/dvb-core/dmxdev.c in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) NULL pointer dereference

EUVDB-ID: #VU71479

Risk: Medium

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-47929

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the traffic control subsystem in Linux kernel. A local user can pass pass a specially crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security features bypass

EUVDB-ID: #VU72469

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-0045

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to Linux kernel does not correctly mitigate SMT attacks. A local user can bypass Spectre-BTI user space mitigations and gain access to sensitive information.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Use-after-free

EUVDB-ID: #VU71482

Risk: High

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2023-0266

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the snd_ctl_elem_read() function in the Linux kernel sound subsystem. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

9) NULL pointer dereference

EUVDB-ID: #VU71352

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0394

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the rawv6_push_pending_frames() function in net/ipv6/raw.c. A local user can run a specially crafted program on the system and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU74123

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1073

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows an attacker to compromise the affected system.

The vulnerability exists due to a boundary error in the Linux kernel human interface device (HID) subsystem. An attacker with physical access to the system can insert in a specific way malicious USB device, trigger memory corruption and execute arbitrary code.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU74124

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1074

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak in Linux kernel Stream Control Transmission Protocol. A local user can start a malicious network service and then connect to remotely, forcing the kernel to leak memory.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU74122

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1281

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Linux kernel traffic control index filter (tcindex) when the tcf_exts_exec() function is called with the destroyed tcf_ext. A local user attacker can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Type Confusion

EUVDB-ID: #VU71477

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23455

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the atm_tc_enqueue() function in net/sched/sch_atm.c in the Linux kernel. A local user can trigger a type confusion error and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Integer overflow

EUVDB-ID: #VU72468

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23559

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the rndis_query_oid() function in drivers/net/wireless/rndis_wlan.c. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Double Free

EUVDB-ID: #VU73766

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-26545

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a double free in net/mpls/af_mpls.c during the renaming of a device. A local user can trigger a double free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) NULL pointer dereference

EUVDB-ID: #VU74126

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28328

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-snapdragon to the latest version.

Vulnerable software versions

Ubuntu: 18.04

linux-image-snapdragon (Ubuntu package): before 4.15.0.1148.147

linux-image-4.15.0-1148-snapdragon (Ubuntu package): before 4.15.0-1148.158

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6030-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.