SB2024010102 - Debian update for linux
Published: January 1, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Race condition (CVE-ID: CVE-2023-6531)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition when the unix garbage collector's deletion of a SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. A local user can exploit the race and escalate privileges on the system.
2) NULL pointer dereference (CVE-ID: CVE-2023-6622)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the nft_dynset_init() function in net/netfilter/nft_dynset.c in nf_tables. A local user can pass specially crafted data to the system and perform a denial of service (DoS) attack.
3) Use-after-free (CVE-ID: CVE-2023-6817)
The vulnerability allows a local authenticated user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the netfilter nf_tables component in Linux kernel. A local authenticated user can trigger a use-after-free error and escalate privileges on the system.
4) Out-of-bounds write (CVE-ID: CVE-2023-6931)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Linux kernel's Performance Events system component. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
5) Use-after-free (CVE-ID: CVE-2023-51779)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error when handling bt_sock_ioctl in the Bluetooth subsystem. A local user can trigger a use-after-free error and execute arbitrary code on the system.
6) Race condition (CVE-ID: CVE-2023-51780)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in the ATM (Asynchronous Transfer Mode) subsystem in Linux kernel. A local user can exploit the race and escalate privileges on the system.
7) Race condition (CVE-ID: CVE-2023-51781)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in the Appletalk subsystem in Linux kernel. A local user can exploit the race and escalate privileges on the system.
8) Race condition (CVE-ID: CVE-2023-51782)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition in the Amateur Radio X.25 PLP (Rose) support. A local user can exploit the race and escalate privileges on the system.
Remediation
Install update from vendor's website.