SB2024032525 - Multiple vulnerabilities in Oracle VM Server for x86



SB2024032525 - Multiple vulnerabilities in Oracle VM Server for x86

Published: March 25, 2024

Security Bulletin ID SB2024032525
Severity
Low
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2023-4921)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the qfq_dequeue() function within the the Linux kernel's net/sched: sch_qfq component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.


2) Double Free (CVE-ID: CVE-2021-34981)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the CMTP module in Linux kernel. A local user can trigger a double free error and execute arbitrary code on the system.


3) Type Confusion (CVE-ID: CVE-2023-1077)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a type confusion error within the pick_next_rt_entity() function pick_next_rt_entity(). A local user can trigger a type confusion error and execute arbitrary code with elevated privileges.


4) Race condition (CVE-ID: CVE-2023-51780)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the ATM (Asynchronous Transfer Mode) subsystem in Linux kernel. A local user can exploit the race and escalate privileges on the system.


5) Use-after-free (CVE-ID: CVE-2024-0775)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __ext4_remount() function in fs/ext4/super.c in ext4. A local user can trigger a use-after-free error and execute arbitrary code on the system.


6) Input validation error (CVE-ID: CVE-2021-33098)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A local user can perform a denial of service (DoS) attack.


7) Input validation error (CVE-ID: CVE-2022-48619)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the input_set_capability() function in drivers/input/input.c. A local user can crash the OS kernel.


8) Integer overflow (CVE-ID: CVE-2023-42752)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow within the __alloc_skb() function. A local user can trigger integer overflow and crash the kernel.


9) Memory leak (CVE-ID: CVE-2023-7192)

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the ctnetlink_create_conntrack() function in net/netfilter/nf_conntrack_netlink.c. A local user with CAP_NET_ADMIN privileges can perform denial of service attack.


10) Improper access control (CVE-ID: CVE-2020-26555)

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the Bluetooth legacy BR/EDR PIN code pairing. An attacker with physical access can spoof the BD_ADDR of the peer device and complete pairing without knowledge of the PIN.


Remediation

Install update from vendor's website.