SB2023061648 - Ubuntu update for linux-oem-5.17 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023061648

SB2023061648 - Ubuntu update for linux-oem-5.17

Published: June 16, 2023

Security Bulletin ID SB2023061648
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2023-0459)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper implementation of speculative execution barriers in usercopy functions
in certain situations. A local user can gain access to sensitive information.


2) Buffer overflow (CVE-ID: CVE-2023-1073)

The vulnerability allows an attacker to compromise the affected system.

The vulnerability exists due to a boundary error in the Linux kernel human interface device (HID) subsystem. An attacker with physical access to the system can insert in a specific way malicious USB device, trigger memory corruption and execute arbitrary code.


3) Use-after-free (CVE-ID: CVE-2023-26606)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ntfs_trim_fs() function in fs/ntfs3/bitmap.c in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.


Remediation

Install update from vendor's website.

References