SB2024022333 - Ubuntu update for linux

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Race condition (CVE-ID: CVE-2023-51780)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the ATM (Asynchronous Transfer Mode) subsystem in Linux kernel. A local user can exploit the race and escalate privileges on the system.

2) Race condition (CVE-ID: CVE-2023-51782)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the Amateur Radio X.25 PLP (Rose) support. A local user can exploit the race and escalate privileges on the system.

3) Memory leak (CVE-ID: CVE-2023-7192)

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the ctnetlink_create_conntrack() function in net/netfilter/nf_conntrack_netlink.c. A local user with CAP_NET_ADMIN privileges can perform denial of service attack.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-6646-1