Ubuntu update for linux



Risk Low
Patch available YES
Number of vulnerabilities 85
CVE-ID CVE-2024-40902
CVE-2024-40905
CVE-2024-41095
CVE-2024-41035
CVE-2024-36974
CVE-2024-40959
CVE-2024-40978
CVE-2024-42236
CVE-2024-40963
CVE-2024-40916
CVE-2024-41006
CVE-2024-39495
CVE-2023-52803
CVE-2024-42070
CVE-2024-41041
CVE-2024-42157
CVE-2024-36894
CVE-2024-42153
CVE-2024-42127
CVE-2024-42224
CVE-2024-40932
CVE-2024-42105
CVE-2024-40968
CVE-2024-41044
CVE-2024-41046
CVE-2023-52887
CVE-2024-42094
CVE-2024-40960
CVE-2024-41007
CVE-2024-40961
CVE-2024-39487
CVE-2024-39502
CVE-2024-42086
CVE-2024-36978
CVE-2024-39503
CVE-2024-41049
CVE-2024-42090
CVE-2024-42232
CVE-2024-39499
CVE-2024-37078
CVE-2024-39501
CVE-2024-42119
CVE-2024-40901
CVE-2024-42101
CVE-2024-42104
CVE-2024-42145
CVE-2024-41097
CVE-2024-40942
CVE-2024-41034
CVE-2024-40904
CVE-2024-41089
CVE-2024-42084
CVE-2024-42093
CVE-2024-40945
CVE-2024-40958
CVE-2024-42124
CVE-2024-40987
CVE-2024-40912
CVE-2024-39506
CVE-2024-40941
CVE-2024-39509
CVE-2024-40974
CVE-2024-39505
CVE-2024-42115
CVE-2024-40988
CVE-2024-40995
CVE-2024-42097
CVE-2024-41087
CVE-2024-42106
CVE-2024-40984
CVE-2024-40981
CVE-2024-42102
CVE-2024-42148
CVE-2024-42154
CVE-2024-42096
CVE-2024-40934
CVE-2024-40980
CVE-2024-42076
CVE-2024-40943
CVE-2024-42092
CVE-2024-42089
CVE-2024-42223
CVE-2024-38619
CVE-2024-42087
CVE-2024-39469
CWE-ID CWE-119
CWE-476
CWE-20
CWE-399
CWE-401
CWE-667
CWE-416
CWE-388
CWE-415
CWE-125
CWE-96
CWE-908
CWE-190
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		Ubuntu
Operating systems & Components / Operating system

linux-image-virtual (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oracle-lts-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem-osp1 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-ibm-lts-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gkeop-5.4 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gkeop (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gcp-lts-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-bluefield (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-azure-lts-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws-lts-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-195-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-195-generic-lpae (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-195-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1137-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1136-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1132-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1131-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1120-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1099-gkeop (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1092-bluefield (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-5.4.0-1079-ibm (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 85 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU94296

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40902

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the ea_get() function in fs/jfs/xattr.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU94257

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40905

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rt6_get_pcpu_route() function in net/ipv6/route.c, within the __fib6_drop_pcpu_from() function in net/ipv6/ip6_fib.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU94966

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41095

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_ld_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU95109

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41035

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the usb_parse_endpoint() function in drivers/usb/core/config.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU93310

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36974

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the taprio_parse_mqprio_opt() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU94246

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40959

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xfrm6_get_saddr() function in net/ipv6/xfrm6_policy.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource management error

EUVDB-ID: #VU94299

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40978

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qedi_dbg_do_not_recover_cmd_read() function in drivers/scsi/qedi/qedi_debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU95502

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usb_string_copy() function in drivers/usb/gadget/configfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU94318

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40963

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bcm6358_quirks() function in arch/mips/bmips/setup.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper locking

EUVDB-ID: #VU94281

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40916

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hdmi_get_modes() function in drivers/gpu/drm/exynos/exynos_hdmi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU94213

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41006

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nr_heartbeat_expiry() function in net/netrom/nr_timer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU94232

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39495

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the gb_interface_release() function in drivers/greybus/interface.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU90079

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52803

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rpc_clnt_remove_pipedir() and rpc_setup_pipedir() functions in net/sunrpc/clnt.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Memory leak

EUVDB-ID: #VU94923

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42070

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_lookup_init() function in net/netfilter/nft_lookup.c, within the nf_tables_fill_setelem() and nft_validate_register_store() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Resource management error

EUVDB-ID: #VU95069

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41041

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sock_set_flag() and spin_unlock() functions in net/ipv4/udp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Input validation error

EUVDB-ID: #VU95090

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42157

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improper locking

EUVDB-ID: #VU90735

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36894

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ffs_user_copy_worker() and ffs_epfile_async_io_complete() functions in drivers/usb/gadget/function/f_fs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper locking

EUVDB-ID: #VU94983

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42153

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the wait_reset(), i2c_pnx_master_xmit(), i2c_pnx_master_rcv(), i2c_pnx_interrupt(), i2c_pnx_timeout(), i2c_pnx_xfer() and i2c_pnx_probe() functions in drivers/i2c/busses/i2c-pnx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Improper error handling

EUVDB-ID: #VU95014

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42127

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the lima_pp_init() and lima_pp_bcast_init() functions in drivers/gpu/drm/lima/lima_pp.c, within the lima_mmu_init() function in drivers/gpu/drm/lima/lima_mmu.c, within the lima_gp_init() function in drivers/gpu/drm/lima/lima_gp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper error handling

EUVDB-ID: #VU95012

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42224

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mv88e6xxx_default_mdio_bus() function in drivers/net/dsa/mv88e6xxx/chip.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Memory leak

EUVDB-ID: #VU94204

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40932

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vidi_get_modes() function in drivers/gpu/drm/exynos/exynos_drm_vidi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU94936

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42105

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_store_disk_layout() function in fs/nilfs2/the_nilfs.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU94319

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40968

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __cvmx_pcie_build_config_addr() function in arch/mips/pci/pcie-octeon.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Input validation error

EUVDB-ID: #VU95108

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41044

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ppp_read() and ppp_write() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Double free

EUVDB-ID: #VU95010

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41046

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ltq_etop_free_channel() function in drivers/net/ethernet/lantiq_etop.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Improper error handling

EUVDB-ID: #VU95018

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52887

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the j1939_xtp_rx_rts_session_new() function in net/can/j1939/transport.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Buffer overflow

EUVDB-ID: #VU95040

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42094

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the iucv_setmask_mp() and iucv_cpu_online() functions in net/iucv/iucv.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) NULL pointer dereference

EUVDB-ID: #VU94245

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40960

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rt6_probe() function in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Resource management error

EUVDB-ID: #VU94345

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41007

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the tcp_rtx_probe0_timed_out() function in net/ipv4/tcp_timer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) NULL pointer dereference

EUVDB-ID: #VU94244

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40961

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fib6_nh_init() function in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Out-of-bounds read

EUVDB-ID: #VU93889

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39487

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bond_option_arp_ip_targets_set() function in drivers/net/bonding/bond_options.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) NULL pointer dereference

EUVDB-ID: #VU94261

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39502

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ionic_qcq_enable() function in drivers/net/ethernet/pensando/ionic/ionic_lif.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Buffer overflow

EUVDB-ID: #VU95041

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42086

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the bme680_compensate_temp(), bme680_compensate_press() and bme680_compensate_humid() functions in drivers/iio/chemical/bme680_core.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Out-of-bounds read

EUVDB-ID: #VU92332

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36978

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the multiq_tune() function in net/sched/sch_multiq.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU94230

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39503

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the list_set_kadd(), list_set_kdel(), list_set_utest(), list_set_uadd(), list_set_udel() and list_set_destroy() functions in net/netfilter/ipset/ip_set_list_set.c, within the call_rcu(), ip_set_destroy() and ip_set_net_init() functions in net/netfilter/ipset/ip_set_core.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU94947

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41049

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the posix_lock_inode() function in fs/locks.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Improper locking

EUVDB-ID: #VU94988

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42090

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the create_pinctrl() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Use-after-free

EUVDB-ID: #VU95503

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42232

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the delayed_work() and EXPORT_SYMBOL() functions in net/ceph/mon_client.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Memory leak

EUVDB-ID: #VU94201

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39499

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the event_deliver() function in drivers/misc/vmw_vmci/vmci_event.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Improper locking

EUVDB-ID: #VU93342

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-37078

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nilfs_segctor_prepare_write() function in fs/nilfs2/segment.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Improper locking

EUVDB-ID: #VU94277

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39501

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the uevent_show() function in drivers/base/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Improper error handling

EUVDB-ID: #VU95015

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42119

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the find_first_free_audio() function in drivers/gpu/drm/amd/display/dc/core/dc_resource.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Out-of-bounds read

EUVDB-ID: #VU94233

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40901

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mpt3sas_base_attach() and _base_check_ioc_facts_changes() functions in drivers/scsi/mpt3sas/mpt3sas_base.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) NULL pointer dereference

EUVDB-ID: #VU94963

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42101

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nouveau_connector_get_modes() function in drivers/gpu/drm/nouveau/nouveau_connector.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Use-after-free

EUVDB-ID: #VU94937

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42104

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_check_page() and nilfs_error() functions in fs/nilfs2/dir.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Resource management error

EUVDB-ID: #VU95067

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41097

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cxacru_bind() function in drivers/usb/atm/cxacru.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Memory leak

EUVDB-ID: #VU94207

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40942

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mesh_path_discard_frame() function in net/mac80211/mesh_pathtbl.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Improper error handling

EUVDB-ID: #VU95020

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41034

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_dotdot() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Improper locking

EUVDB-ID: #VU94283

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40904

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the wdm_int_callback() function in drivers/usb/class/cdc-wdm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) NULL pointer dereference

EUVDB-ID: #VU94971

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41089

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_hd_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Improper neutralization of directives in statically saved code (\'static code injection\')

EUVDB-ID: #VU95052

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42084

CWE-ID: CWE-96 - Improper Neutralization of Directives in Statically Saved Code (\'Static Code Injection\')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Buffer overflow

EUVDB-ID: #VU95039

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42093

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dpaa2_eth_xdp_xmit() and update_xps() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) NULL pointer dereference

EUVDB-ID: #VU94250

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40945

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/iommu.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Use-after-free

EUVDB-ID: #VU94215

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40958

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL_GPL() function in net/core/net_namespace.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Input validation error

EUVDB-ID: #VU95097

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42124

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qedf_execute_tmf() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Resource management error

EUVDB-ID: #VU94307

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40987

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sumo_construct_vid_mapping_table() function in drivers/gpu/drm/amd/amdgpu/kv_dpm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Improper locking

EUVDB-ID: #VU94282

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40912

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ieee80211_sta_ps_deliver_wakeup() function in net/mac80211/sta_info.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) NULL pointer dereference

EUVDB-ID: #VU94258

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39506

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lio_vf_rep_copy_packet() function in drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Buffer overflow

EUVDB-ID: #VU94315

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40941

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the iwl_mvm_mfu_assert_dump_notif() function in drivers/net/wireless/intel/iwlwifi/mvm/fw.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Resource management error

EUVDB-ID: #VU94310

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39509

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the implement() function in drivers/hid/hid-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Buffer overflow

EUVDB-ID: #VU94301

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40974

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the arch/powerpc/include/asm/hvcall.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) NULL pointer dereference

EUVDB-ID: #VU94259

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39505

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the komeda_component_get_avail_scaler() function in drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Use-after-free

EUVDB-ID: #VU94932

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42115

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the jffs2_i_init_once() function in fs/jffs2/super.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Resource management error

EUVDB-ID: #VU94308

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40988

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sumo_construct_vid_mapping_table() function in drivers/gpu/drm/radeon/sumo_dpm.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Improper locking

EUVDB-ID: #VU94267

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40995

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tcf_idr_check_alloc() and rcu_read_unlock() functions in net/sched/act_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Input validation error

EUVDB-ID: #VU95001

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42097

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the load_data() and load_guspatch() functions in sound/synth/emux/soundfont.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Double free

EUVDB-ID: #VU95008

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41087

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ata_host_alloc() function in drivers/ata/libata-core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Use of uninitialized resource

EUVDB-ID: #VU95024

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42106

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_dump_compat() and inet_diag_get_exact_compat() functions in net/ipv4/inet_diag.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) NULL pointer dereference

EUVDB-ID: #VU94239

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40984

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the acpi_ex_system_memory_space_handler() function in drivers/acpi/acpica/exregion.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Improper locking

EUVDB-ID: #VU94269

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40981

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the batadv_purge_orig_ref() function in net/batman-adv/originator.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Integer overflow

EUVDB-ID: #VU95034

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42102

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the wb_dirty_limits() function in mm/page-writeback.c. A local user can execute arbitrary code.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Out-of-bounds read

EUVDB-ID: #VU94952

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42148

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/net/ethernet/broadcom/bnx2x/bnx2x.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU95093

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42154

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the sizeof() function in net/ipv4/tcp_metrics.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Improper locking

EUVDB-ID: #VU94987

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42096

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the profile_pc() function in arch/x86/kernel/time.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Memory leak

EUVDB-ID: #VU94205

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40934

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the logi_dj_recv_switch_to_dj_mode() function in drivers/hid/hid-logitech-dj.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Improper locking

EUVDB-ID: #VU94270

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40980

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the reset_per_cpu_data(), trace_drop_common(), net_dm_hw_reset_per_cpu_data(), net_dm_hw_summary_probe() and __net_dm_cpu_data_init() functions in net/core/drop_monitor.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Use of uninitialized resource

EUVDB-ID: #VU95031

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42076

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the MODULE_ALIAS() and j1939_send_one() functions in net/can/j1939/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Improper locking

EUVDB-ID: #VU94278

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40943

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __ocfs2_change_file_space() function in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Input validation error

EUVDB-ID: #VU95000

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42092

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the davinci_gpio_probe() function in drivers/gpio/gpio-davinci.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) NULL pointer dereference

EUVDB-ID: #VU94964

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42089

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fsl_asoc_card_probe() function in sound/soc/fsl/fsl-asoc-card.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Integer overflow

EUVDB-ID: #VU95037

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42223

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the tda10048_set_if() function in drivers/media/dvb-frontends/tda10048.c. A local user can execute arbitrary code.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Use of uninitialized resource

EUVDB-ID: #VU93082

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38619

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the short_pack() and alauda_check_media() functions in drivers/usb/storage/alauda.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Resource management error

EUVDB-ID: #VU95066

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42087

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ili9881c_prepare() and ili9881c_unprepare() functions in drivers/gpu/drm/panel/panel-ilitek-ili9881c.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Improper error handling

EUVDB-ID: #VU93336

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39469

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_empty_dir() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-virtual (Ubuntu package): before 5.4.0.195.193

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1131.124

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.195.193

linux-image-oem (Ubuntu package): before 5.4.0.195.193

linux-image-lowlatency (Ubuntu package): before 5.4.0.195.193

linux-image-kvm (Ubuntu package): before 5.4.0.1120.116

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1079.108

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1099.97

linux-image-gkeop (Ubuntu package): before 5.4.0.1099.97

linux-image-generic-lpae (Ubuntu package): before 5.4.0.195.193

linux-image-generic (Ubuntu package): before 5.4.0.195.193

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1136.138

linux-image-bluefield (Ubuntu package): before 5.4.0.1092.88

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1137.131

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1132.129

linux-image-5.4.0-195-lowlatency (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic-lpae (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-195-generic (Ubuntu package): before 5.4.0-195.215

linux-image-5.4.0-1137-azure (Ubuntu package): before 5.4.0-1137.144

linux-image-5.4.0-1136-gcp (Ubuntu package): before 5.4.0-1136.145

linux-image-5.4.0-1132-aws (Ubuntu package): before 5.4.0-1132.142

linux-image-5.4.0-1131-oracle (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1120-kvm (Ubuntu package): before 5.4.0-1120.128

linux-image-5.4.0-1099-gkeop (Ubuntu package): before 5.4.0-1099.103

linux-image-5.4.0-1092-bluefield (Ubuntu package): before 5.4.0-1092.99

linux-image-5.4.0-1079-ibm (Ubuntu package): before 5.4.0-1079.84

CPE2.3 External links

http://ubuntu.com/security/notices/USN-7003-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###