Ubuntu update for linux

Published: 2022-04-21

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-0617 CVE-2022-24448 CVE-2022-24959
CWE-ID	CWE-476 CWE-909 CWE-401
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system linux-image-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1072-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gke-5.4 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-109-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1039-gkeop (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1072-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-109-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi2 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1020-ibm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1070-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-aws-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1076-azure-fde (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-ibm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gke (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1077-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure-fde (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gkeop-5.4 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-ibm-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1068-gke (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem-osp1 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1059-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gkeop (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-109-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1062-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-snapdragon-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU61210

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-0617

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel UDF file system functionality. A local user can supply a malicious UDF image to the udf_file_write_iter() function and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 20.04

linux-image-lowlatency (Ubuntu package): before 5.4.0.109.113

linux-image-5.4.0-1072-aws (Ubuntu package): before 5.4.0-1072.77

linux-image-generic-lpae (Ubuntu package): before 5.4.0.109.113

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1070.70

linux-image-kvm (Ubuntu package): before 5.4.0.1062.61

linux-image-gke-5.4 (Ubuntu package): before 5.4.0.1068.78

linux-image-raspi (Ubuntu package): before 5.4.0.1059.93

linux-image-5.4.0-109-generic (Ubuntu package): before 5.4.0-109.123~18.04.1

linux-image-5.4.0-1039-gkeop (Ubuntu package): before 5.4.0-1039.40~18.04.1

linux-image-5.4.0-1072-gcp (Ubuntu package): before 5.4.0-1072.77~18.04.1

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1072.80

linux-image-5.4.0-109-lowlatency (Ubuntu package): before 5.4.0-109.123~18.04.1

linux-image-raspi2 (Ubuntu package): before 5.4.0.1059.93

linux-image-5.4.0-1020-ibm (Ubuntu package): before 5.4.0-1020.22~18.04.1

linux-image-5.4.0-1070-oracle (Ubuntu package): before 5.4.0-1070.76~18.04.1

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1072.74

linux-image-5.4.0-1076-azure-fde (Ubuntu package): before 5.4.0-1076.79+cvm1.1

linux-image-ibm (Ubuntu package): before 5.4.0.1020.37

linux-image-gke (Ubuntu package): before 5.4.0.1068.78

linux-image-5.4.0-1077-azure (Ubuntu package): before 5.4.0-1077.80~18.04.1

linux-image-azure-fde (Ubuntu package): before 5.4.0.1076.79+cvm1.21

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1039.42

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1077.75

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1020.20

linux-image-5.4.0-1068-gke (Ubuntu package): before 5.4.0-1068.71~18.04.1

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-5.4.0-1059-raspi (Ubuntu package): before 5.4.0-1059.67

linux-image-oem (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-generic (Ubuntu package): before 5.4.0.109.113

linux-image-virtual (Ubuntu package): before 5.4.0.109.113

linux-image-gkeop (Ubuntu package): before 5.4.0.1039.42

linux-image-5.4.0-109-generic-lpae (Ubuntu package): before 5.4.0-109.123~18.04.1

linux-image-5.4.0-1062-kvm (Ubuntu package): before 5.4.0-1062.65

linux-image-virtual-hwe-18.04 (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-snapdragon-hwe-18.04 (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-raspi-hwe-18.04 (Ubuntu package): before 5.4.0.1059.60

linux-image-oracle (Ubuntu package): before 5.4.0.1070.76~18.04.49

linux-image-lowlatency-hwe-18.04 (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-generic-lpae-hwe-18.04 (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-generic-hwe-18.04 (Ubuntu package): before 5.4.0.109.123~18.04.94

linux-image-gcp (Ubuntu package): before 5.4.0.1072.56

linux-image-azure (Ubuntu package): before 5.4.0.1077.56

Fixed software versions

CPE2.3

cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*

External links

http://ubuntu.com/security/notices/USN-5384-1

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Missing initialization of resource

EUVDB-ID: #VU61211

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-24448

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource within the fs/nfs/dir.c in the Linux kernel. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.