Ubuntu update for linux-oem-6.0

Published: 2023-05-10 | Updated: 2024-09-26

Risk	Medium
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2023-0386 CVE-2023-0468 CVE-2023-1829 CVE-2023-1859 CVE-2023-23455 CVE-2023-26545
CWE-ID	CWE-264 CWE-476 CWE-416 CWE-843 CWE-415
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #3 is available.
Vulnerable software	Ubuntu Operating systems & Components / Operating system linux-image-6.0.0-1015-oem (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem-22.04b (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU74410

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2023-0386

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unauthorized access to execution of setuid files in OverlayFS subsystem when copying a capable file from a nosuid mount into another mount. A local user can execute arbitrary code with root privileges.

Mitigation

Update the affected package linux-oem-6.0 to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-6.0.0-1015-oem (Ubuntu package): before 6.0.0-1015.15

linux-image-oem-22.04b (Ubuntu package): before 6.0.0.1015.15

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6072-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

2) NULL pointer dereference

EUVDB-ID: #VU72343

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0468

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the io_poll_check_events() function in io_uring/poll.c within the io_uring subcomponent in the Linux Kernel. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-oem-6.0 to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-6.0.0-1015-oem (Ubuntu package): before 6.0.0-1015.15

linux-image-oem-22.04b (Ubuntu package): before 6.0.0.1015.15

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6072-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU75448

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-1829

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tcindex_delete() function. A local user can trigger a use-after-free error and execute arbitrary code with root privileges.

Mitigation

Update the affected package linux-oem-6.0 to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-6.0.0-1015-oem (Ubuntu package): before 6.0.0-1015.15

linux-image-oem-22.04b (Ubuntu package): before 6.0.0.1015.15

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6072-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Use-after-free

EUVDB-ID: #VU75769

Risk: Medium

CVSSv4.0: 4.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-1859

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a malicious guest to gain access to sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the xen_9pfs_front_removet() function in net/9p/trans_xen.c in Xen transport for 9pfs. A malicious guest VM can trigger a use-after-free error and gain access to sensitive information of the hypervisor or crash it.

Mitigation

Update the affected package linux-oem-6.0 to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-6.0.0-1015-oem (Ubuntu package): before 6.0.0-1015.15

linux-image-oem-22.04b (Ubuntu package): before 6.0.0.1015.15

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6072-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Type Confusion

EUVDB-ID: #VU71477

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23455

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the atm_tc_enqueue() function in net/sched/sch_atm.c in the Linux kernel. A local user can trigger a type confusion error and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-oem-6.0 to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-6.0.0-1015-oem (Ubuntu package): before 6.0.0-1015.15

linux-image-oem-22.04b (Ubuntu package): before 6.0.0.1015.15

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6072-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Double Free

EUVDB-ID: #VU73766

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-26545

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a double free in net/mpls/af_mpls.c during the renaming of a device. A local user can trigger a double free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-oem-6.0 to the latest version.

Vulnerable software versions

Ubuntu: 22.04

linux-image-6.0.0-1015-oem (Ubuntu package): before 6.0.0-1015.15

linux-image-oem-22.04b (Ubuntu package): before 6.0.0.1015.15

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6072-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.