Ubuntu update for linux

Published: 2024-09-18

Risk	Low
Patch available	YES
Number of vulnerabilities	10
CVE-ID	CVE-2021-47188 CVE-2024-27012 CVE-2024-42228 CVE-2022-48791 CVE-2024-39494 CVE-2022-48863 CVE-2024-26787 CVE-2024-42160 CVE-2024-38570 CVE-2024-26677
CWE-ID	CWE-399 CWE-401 CWE-908 CWE-416 CWE-200 CWE-20
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system linux-image-xilinx-zynqmp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem-osp1 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-ibm-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gkeop-5.4 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gkeop (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-bluefield (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-aws-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-196-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-196-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-196-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1138-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1137-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1133-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1132-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1121-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1100-gkeop (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1093-bluefield (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1080-ibm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1052-xilinx-zynqmp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-snapdragon-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-ibm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 10 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU93843

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47188

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ufshcd_abort() function in drivers/scsi/ufs/ufshcd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 20.04

linux-image-xilinx-zynqmp (Ubuntu package): before 5.4.0.1052.52

linux-image-virtual (Ubuntu package): before 5.4.0.196.194

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1132.125

linux-image-oem-osp1 (Ubuntu package): before Ubuntu Pro

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency (Ubuntu package): before 5.4.0.196.194

linux-image-kvm (Ubuntu package): before 5.4.0.1121.117

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1080.109

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1100.98

linux-image-gkeop (Ubuntu package): before 5.4.0.1100.98

linux-image-generic-lpae (Ubuntu package): before 5.4.0.196.194

linux-image-generic (Ubuntu package): before 5.4.0.196.194

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1137.139

linux-image-bluefield (Ubuntu package): before 5.4.0.1093.89

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1138.132

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1133.130

linux-image-5.4.0-196-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-196-generic-lpae (Ubuntu package): before 5.4.0-196.216

linux-image-5.4.0-196-generic (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1138-azure (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1137-gcp (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1133-aws (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1132-oracle (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1121-kvm (Ubuntu package): before 5.4.0-1121.129

linux-image-5.4.0-1100-gkeop (Ubuntu package): before 5.4.0-1100.104

linux-image-5.4.0-1093-bluefield (Ubuntu package): before 5.4.0-1093.100

linux-image-5.4.0-1080-ibm (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1052-xilinx-zynqmp (Ubuntu package): before 5.4.0-1052.56

linux-image-lowlatency-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-virtual-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-snapdragon-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-generic-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-ibm (Ubuntu package): before Ubuntu Pro

linux-image-aws (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-7022-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU90461

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27012

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_rbtree_activate() and nft_rbtree_walk() functions in net/netfilter/nft_set_rbtree.c, within the nft_pipapo_activate() and nft_pipapo_walk() functions in net/netfilter/nft_set_pipapo.c, within the nft_rhash_activate(), nft_rhash_walk(), nft_hash_activate() and nft_hash_walk() functions in net/netfilter/nft_set_hash.c, within the nft_bitmap_activate() and nft_bitmap_walk() functions in net/netfilter/nft_set_bitmap.c, within the nft_mapelem_deactivate(), nft_map_catchall_deactivate(), nft_setelem_validate(), nf_tables_bind_check_setelem(), nft_mapelem_activate(), nft_map_catchall_activate(), nf_tables_dump_setelem(), nft_setelem_activate(), nft_setelem_flush() and nf_tables_loop_check_setelem() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.