Ubuntu update for linux-aws

1) NULL pointer dereference

EUVDB-ID: #VU73764

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-38096

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU88102

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-23307

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow in raid5_cache_count() function. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Race condition

EUVDB-ID: #VU92719

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-24857

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Race condition

EUVDB-ID: #VU92720

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-24858

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Race condition

EUVDB-ID: #VU92721

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-24859

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Race condition

EUVDB-ID: #VU91634

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-24861

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the xc4000 xc4000_get_frequency() function in the media/xc4000 device driver. A local user can exploit the race and escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper check for unusual or exceptional conditions

EUVDB-ID: #VU92399

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-25739

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper check for unusual or exceptional conditions error within the ubi_read_volume_table() function in drivers/mtd/ubi/vtbl.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU90163

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35855

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlxsw_sp_acl_tcam_ventry_activity_get() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource management error

EUVDB-ID: #VU93839

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35944

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the dg_dispatch_as_host() function in drivers/misc/vmw_vmci/vmci_datagram.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) NULL pointer dereference

EUVDB-ID: #VU90839

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35851

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qca_prevent_wake() function in drivers/bluetooth/hci_qca.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) NULL pointer dereference

EUVDB-ID: #VU90553

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35796

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the temac_probe() function in drivers/net/ethernet/xilinx/ll_temac_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper locking

EUVDB-ID: #VU91529

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26812

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vfio_send_intx_eventfd(), vfio_intx_handler() and vfio_pci_set_intx_trigger() functions in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper error handling

EUVDB-ID: #VU92058

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26814

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the vfio_fsl_mc_set_irq_trigger() function in drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper locking

EUVDB-ID: #VU91448

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35819

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qman_create_portal(), qm_congestion_task(), qman_create_cgr(), qman_delete_cgr() and qman_update_cgr() functions in drivers/soc/fsl/qbman/qman.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper locking

EUVDB-ID: #VU90774

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26976

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the async_pf_execute(), kvm_clear_async_pf_completion_queue(), kvm_check_async_pf_completion() and kvm_setup_async_pf() functions in virt/kvm/async_pf.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper error handling

EUVDB-ID: #VU90947

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35809

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the pci_device_remove() function in drivers/pci/pci-driver.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Use of uninitialized resource

EUVDB-ID: #VU90872

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35973

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the geneve_xmit_skb() and geneve6_xmit_skb() functions in drivers/net/geneve.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) NULL pointer dereference

EUVDB-ID: #VU90561

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26964

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xhci_map_temp_buffer() function in drivers/usb/host/xhci.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Memory leak

EUVDB-ID: #VU89983

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35852

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mlxsw_sp_acl_tcam_vregion_destroy() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Resource management error

EUVDB-ID: #VU93196

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27018

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to resource management error within the nf_ct_bridge_pre() function in net/bridge/netfilter/nf_conntrack_bridge.c, within the br_nf_local_in() function in net/bridge/br_netfilter_hooks.c, within the br_netif_receive_skb(), br_pass_frame_up(), br_handle_frame_finish() and br_handle_frame() functions in net/bridge/br_input.c. A local user can execute arbitrary code.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Use-after-free

EUVDB-ID: #VU90183

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26958

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the , within the wait_on_commit() function in fs/nfs/write.c, within the nfs_direct_commit_schedule() function in fs/nfs/direct.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Memory leak

EUVDB-ID: #VU93609

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35893

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tcf_skbmod_dump() function in net/sched/act_skbmod.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) NULL pointer dereference

EUVDB-ID: #VU90509

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35885

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlxbf_gige_shutdown() function in drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) NULL pointer dereference

EUVDB-ID: #VU91460

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26950

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the get_peer() function in drivers/net/wireguard/netlink.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Race condition

EUVDB-ID: #VU88148

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26654

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in sound/sh/aica.c. A local user can exploit the race and escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Information disclosure

EUVDB-ID: #VU91355

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26993

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the sysfs_break_active_protection() function in fs/sysfs/file.c. A local user can gain access to sensitive information.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use-after-free

EUVDB-ID: #VU91062

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26957

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the zcrypt_pick_queue() and zcrypt_drop_queue() functions in drivers/s390/crypto/zcrypt_api.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Out-of-bounds read

EUVDB-ID: #VU90308

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35907

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mlxbf_gige_open() function in drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) NULL pointer dereference

EUVDB-ID: #VU90557

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26984

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv50_instobj_acquire() function in drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Improper locking

EUVDB-ID: #VU90755

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35806

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qm_congestion_task() and qman_create_cgr() functions in drivers/soc/fsl/qbman/qman.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Input validation error

EUVDB-ID: #VU94125

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35988

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the arch/riscv/include/asm/pgtable.h. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Memory leak

EUVDB-ID: #VU89976

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35930

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lpfc_rcv_padisc() function in drivers/scsi/lpfc/lpfc_nportdisc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Race condition

EUVDB-ID: #VU91474

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27009

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the ccw_device_set_online() function in drivers/s390/cio/device.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Race condition within a thread

EUVDB-ID: #VU91432

Risk: Low

CVSSv3.1: 6.1 [AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27020

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a data race within the __nft_expr_type_get() and nft_expr_type_get() functions in net/netfilter/nf_tables_api.c. A local user can execute arbitrary code.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Out-of-bounds read

EUVDB-ID: #VU90307

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35905

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the check_stack_access_within_bounds() function in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) NULL pointer dereference

EUVDB-ID: #VU91235

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35857

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the icmp_build_probe() function in net/ipv4/icmp.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Improper locking

EUVDB-ID: #VU90751

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52699

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the block_end(), get_branch(), get_block() and find_shared() functions in fs/sysv/itree.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) NULL pointer dereference

EUVDB-ID: #VU91234

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35902

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __rds_rdma_map() function in net/rds/rdma.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Improper locking

EUVDB-ID: #VU90752

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35895

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __sock_map_delete() and sock_hash_delete_elem() functions in net/core/sock_map.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Improper locking

EUVDB-ID: #VU92020

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35934

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the smc_pnet_create_pnetids_list() function in net/smc/smc_pnet.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Memory leak

EUVDB-ID: #VU89984

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35853

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mlxsw_sp_acl_tcam_vchunk_migrate_start() and mlxsw_sp_acl_tcam_vregion_migrate() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Reachable assertion

EUVDB-ID: #VU90909

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26937

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the gen11_emit_fini_breadcrumb_rcs() function in drivers/gpu/drm/i915/gt/intel_lrc.c, within the __engine_park() function in drivers/gpu/drm/i915/gt/intel_engine_pm.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Improper locking

EUVDB-ID: #VU91521

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27013

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tun_put_user() function in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) NULL pointer dereference

EUVDB-ID: #VU90588

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26813

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vfio_platform_set_irq_unmask(), vfio_automasked_irq_handler(), vfio_irq_handler(), vfio_set_trigger(), vfio_platform_set_irq_trigger(), vfio_platform_set_irqs_ioctl(), vfio_platform_irq_init() and vfio_platform_irq_cleanup() functions in drivers/vfio/platform/vfio_platform_irq.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Division by zero

EUVDB-ID: #VU91373

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35925

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the blk_rq_stat_init() function in block/blk-stat.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Buffer overflow

EUVDB-ID: #VU93155

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26956

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nilfs_direct_lookup_contig() function in fs/nilfs2/direct.c, within the nilfs_btree_lookup_contig() function in fs/nilfs2/btree.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Information disclosure

EUVDB-ID: #VU91358

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26935

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the scsi_host_dev_release() function in drivers/scsi/hosts.c. A local user can gain access to sensitive information.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Improper locking

EUVDB-ID: #VU92034

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26925

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nf_tables_abort() and nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Use of Out-of-range Pointer Offset

EUVDB-ID: #VU91119

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26926

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the binder_get_object() function in drivers/android/binder.c. A local user can influence the pointer offset and potentially execute arbitrary code.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Division by zero

EUVDB-ID: #VU91372

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35922

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the fb_get_mode() and fb_videomode_from_videomode() functions in drivers/video/fbdev/core/fbmon.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Incorrect calculation

EUVDB-ID: #VU93614

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35813

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the __mmc_blk_ioctl_cmd() function in drivers/mmc/core/block.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Information disclosure

EUVDB-ID: #VU91360

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26973

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the fat_encode_fh_nostale() function in fs/fat/nfs.c. A local user can gain access to sensitive information.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use-after-free

EUVDB-ID: #VU90186

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26961

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mac802154_llsec_key_del_rcu() function in net/mac802154/llsec.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Improper locking

EUVDB-ID: #VU90776

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26934

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper locking within the interface_authorized_store() function in drivers/usb/core/sysfs.c. A local user can execute arbitrary code.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Improper locking

EUVDB-ID: #VU92043

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26687

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the shutdown_pirq() and __unbind_from_irq() functions in drivers/xen/events/events_base.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Incorrect calculation

EUVDB-ID: #VU93613

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35900

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the nf_tables_addchain() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Memory leak

EUVDB-ID: #VU91639

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35871

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the __asm__() and copy_thread() functions in arch/riscv/kernel/process.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Out-of-bounds read

EUVDB-ID: #VU90309

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35896

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_replace() and compat_do_replace() functions in net/ipv6/netfilter/ip6_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/ip_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/arp_tables.c, within the do_replace(), update_counters() and compat_update_counters() functions in net/bridge/netfilter/ebtables.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Resource management error

EUVDB-ID: #VU93190

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36005

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nft_netdev_event() function in net/netfilter/nft_chain_filter.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Resource management error

EUVDB-ID: #VU93297

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26989

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the kernel_page_present() function in arch/arm64/mm/pageattr.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Resource management error

EUVDB-ID: #VU93270

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35807

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the EXT4_DESC_PER_BLOCK() function in fs/ext4/resize.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Use-after-free

EUVDB-ID: #VU90167

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35789

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ieee80211_change_station() function in net/mac80211/cfg.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Out-of-bounds read

EUVDB-ID: #VU91398

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26970

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/gcc-ipq6018.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Improper error handling

EUVDB-ID: #VU90944

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35935

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the iterate_inode_ref() function in fs/btrfs/send.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Out-of-bounds read

EUVDB-ID: #VU91095

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27008

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the apply_dcb_encoder_quirks() and fabricate_dcb_encoder_table() functions in drivers/gpu/drm/nouveau/nouveau_bios.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Out-of-bounds read

EUVDB-ID: #VU90318

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26981

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nilfs_type_by_mode[() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Resource management error

EUVDB-ID: #VU93269

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35897

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nf_tables_table_disable() and nf_tables_updtable() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Buffer overflow

EUVDB-ID: #VU93305

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26988

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the setup_command_line() function in init/main.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper access control

EUVDB-ID: #VU88150

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26642

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions within the nf_tables_newset() function in net/netfilter/nf_tables_api.c. A local user can set arbitrary timeouts, which can result in a denial of service condition.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Infinite loop

EUVDB-ID: #VU91412

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35997

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the __i2c_hid_command() and i2c_hid_irq() functions in drivers/hid/i2c-hid/i2c-hid-core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Use of uninitialized resource

EUVDB-ID: #VU90874

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35915

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the nci_rx_work() function in net/nfc/nci/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Improper locking

EUVDB-ID: #VU93464

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35822

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the usb_ep_queue() function in drivers/usb/gadget/udc/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Out-of-bounds read

EUVDB-ID: #VU91394

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26966

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/mmcc-apq8084.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Race condition within a thread

EUVDB-ID: #VU91431

Risk: Low

CVSSv3.1: 4.1 [AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27019

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a data race within the __nft_obj_type_get() and nft_obj_type_get() functions in net/netfilter/nf_tables_api.c. A local user can gain access to sensitive information.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Out-of-bounds read

EUVDB-ID: #VU91393

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26965

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/mmcc-msm8974.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Buffer overflow

EUVDB-ID: #VU93150

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35884

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the udp_gro_receive() function in net/ipv4/udp_offload.c, within the __udp_is_mcast_sock() function in net/ipv4/udp.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Use-after-free

EUVDB-ID: #VU90143

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35969

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ipv6_get_ifaddr() function in net/ipv6/addrconf.c, within the in6_ifa_hold() function in include/net/addrconf.h. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Off-by-one

EUVDB-ID: #VU91172

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36025

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the qla_edif_app_getstats() function in drivers/scsi/qla2xxx/qla_edif.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Improper locking

EUVDB-ID: #VU91450

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27000

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mxs_auart_set_ldisc() and mxs_auart_irq_handle() functions in drivers/tty/serial/mxs-auart.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Integer overflow

EUVDB-ID: #VU88544

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26817

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the kfd_ioctl_get_process_apertures_new() function in drivers/gpu/drm/amd/amdkfd/kfd_chardev.c. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Memory leak

EUVDB-ID: #VU89973

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35978

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the hci_req_sync_complete() function in net/bluetooth/hci_request.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Double free

EUVDB-ID: #VU90894

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26929

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a double free error within the qla2x00_els_dcmd_sp_free() and qla24xx_els_dcmd_iocb() functions in drivers/scsi/qla2xxx/qla_iocb.c. A local user can execute arbitrary code.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Use-after-free

EUVDB-ID: #VU90169

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27395

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ovs_ct_limit_exit() function in net/openvswitch/conntrack.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Buffer overflow

EUVDB-ID: #VU93241

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35825

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the drivers/usb/gadget/function/f_ncm.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Incorrect calculation

EUVDB-ID: #VU93612

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36007

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the mlxsw_sp_acl_tcam_vregion_rehash_work(), mlxsw_sp_acl_tcam_rehash_ctx_vregion_changed(), mlxsw_sp_acl_tcam_vchunk_migrate_end(), mlxsw_sp_acl_tcam_vchunk_migrate_one(), mlxsw_sp_acl_tcam_vregion_migrate() and mlxsw_sp_acl_tcam_vregion_rehash_start() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Infinite loop

EUVDB-ID: #VU91413

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35886

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the inet6_dump_fib() function in net/ipv6/ip6_fib.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Use-after-free

EUVDB-ID: #VU90162

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35854

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlxsw_sp_acl_tcam_vregion_rehash() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU89899

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52880

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to missing permissions checks within the gsmld_open() function in drivers/tty/n_gsm.c. A local user with CAP_NET_ADMIN capability can create a GSM network.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper locking

EUVDB-ID: #VU91536

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26629

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the check_for_locks() and nfsd4_release_lockowner() functions in fs/nfsd/nfs4state.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Improper error handling

EUVDB-ID: #VU90949

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35785

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the optee_register_device() function in drivers/tee/optee/device.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Improper Initialization

EUVDB-ID: #VU93351

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35960

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the add_rule_fg() function in drivers/net/ethernet/mellanox/mlx5/core/fs_core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Buffer overflow

EUVDB-ID: #VU93243

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26994

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the get_word() function in drivers/accessibility/speakup/main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Input validation error

EUVDB-ID: #VU94144

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52488

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the sc16is7xx_fifo_read(), sc16is7xx_fifo_write() and sc16is7xx_regmap_precious() functions in drivers/tty/serial/sc16is7xx.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Memory leak

EUVDB-ID: #VU91644

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26977

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the pci_iounmap() function in lib/pci_iomap.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Division by zero

EUVDB-ID: #VU91374

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27059

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the isd200_dump_driveid(), isd200_get_inquiry_data() and isd200_init_info() functions in drivers/usb/storage/isd200.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Memory leak

EUVDB-ID: #VU89353

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27393

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a malicious guest to perform DoS attack on the target system.

The vulnerability exists due memory leak within the xennet_alloc_one_rx_buffer() function in xen-netback implementation. A malicious guest userspace process can exhaust memory resources within the guest kernel and perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Improper locking

EUVDB-ID: #VU91449

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26999

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pmz_receive_chars() function in drivers/tty/serial/pmac_zilog.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Information disclosure

EUVDB-ID: #VU91345

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35849

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the init_data_container() function in fs/btrfs/backref.c. A local user can gain access to sensitive information.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) NULL pointer dereference

EUVDB-ID: #VU92068

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36008

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip_route_use_hint() function in net/ipv4/route.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Out-of-bounds read

EUVDB-ID: #VU91397

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26969

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the F() function in drivers/clk/qcom/gcc-ipq8074.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Use-after-free

EUVDB-ID: #VU90160

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35899

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nf_tables_module_exit() function in net/netfilter/nf_tables_api.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) NULL pointer dereference

EUVDB-ID: #VU90507

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35933

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the btintel_read_version() function in drivers/bluetooth/btintel.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Resource management error

EUVDB-ID: #VU93255

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35958

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ena_unmap_tx_buff() and ena_free_tx_bufs() functions in drivers/net/ethernet/amazon/ena/ena_netdev.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Resource management error

EUVDB-ID: #VU92969

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27001

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vmk80xx_find_usb_endpoints() function in drivers/comedi/drivers/vmk80xx.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) NULL pointer dereference

EUVDB-ID: #VU90542

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35940

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the psz_kmsg_read() function in fs/pstore/zone.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) NULL pointer dereference

EUVDB-ID: #VU90563

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26931

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qlt_free_session_done() function in drivers/scsi/qla2xxx/qla_target.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Resource management error

EUVDB-ID: #VU93838

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36006

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mlxsw_sp_acl_tcam_vchunk_migrate_one() and mlxsw_sp_acl_tcam_vchunk_migrate_all() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use-after-free

EUVDB-ID: #VU90145

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35955

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the check_kprobe_address_safe() function in kernel/kprobes.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Buffer overflow

EUVDB-ID: #VU88543

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26811

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when installing malicious ksmbd-tools. A local user can force the ksmbd.mountd to return invalid ipc response to ksmbd kernel server,  trigger memory corruption and execute arbitrary code on the target system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Resource management error

EUVDB-ID: #VU93256

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35872

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the include/linux/secretmem.h. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Input validation error

EUVDB-ID: #VU94121

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36031

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __key_instantiate_and_link() function in security/keys/key.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Race condition

EUVDB-ID: #VU91475

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26960

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the __swap_entry_free_locked() and free_swap_and_cache() functions in mm/swapfile.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Use-after-free

EUVDB-ID: #VU90184

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26996

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ncm_set_alt() and ncm_disable() functions in drivers/usb/gadget/function/f_ncm.c. A local user can escalate privileges on the system.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-azure-fde-lts-22.04 (Ubuntu package): before 5.15.0.1068.77.45

linux-image-aws-lts-22.04 (Ubuntu package): before 5.15.0.1065.65

linux-image-5.15.0-1068-azure-fde (Ubuntu package): before 5.15.0-1068.77~20.04.1.1

linux-image-5.15.0-1065-aws (Ubuntu package): before 5.15.0-1065.71

• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-6898-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Buffer overflow

EUVDB-ID: #VU93152

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35804

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the emulator_cmpxchg_emulated() function in arch/x86/kvm/x86.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux-aws to the latest version.

Ubuntu: 20.04 - 22.04

linux-image-virtual-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04d (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04c (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04b (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-oem-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-lpae-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-generic-64k-hwe-20.04 (Ubuntu package): before 5.15.0.116.126~20.04.1

linux-image-azure-fde (Ubuntu package): before 5.15.0.1068.77~20.04.1.45

linux-image-5.15.0-116-generic-lpae (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic-64k (Ubuntu package): before 5.15.0-116.126~20.04.1

linux-image-5.15.0-116-generic (Ubuntu package): before 5.15.0-116.126~20.04.1