Ubuntu update for linux-oem-5.14



Published: 2022-04-21 | Updated: 2023-09-08
Risk Medium
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2022-0494
CVE-2022-0854
CVE-2022-1011
CVE-2022-1015
CVE-2022-1016
CVE-2022-1048
CVE-2022-24958
CVE-2022-26490
CVE-2022-26966
CVE-2022-27223
CVE-2022-28356
CWE-ID CWE-200
CWE-401
CWE-416
CWE-787
CWE-763
CWE-119
CWE-129
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe 		Ubuntu
Operating systems & Components / Operating system

linux-image-5.14.0-1033-oem (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem-20.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem-20.04d (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem-20.04b (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem-20.04c (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU64259

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0494

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the scsi_ioctl() function in drivers/scsi/scsi_ioctl.c in the Linux kernel. A local user with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU63427

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0854

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in the Linux kernel’s DMA subsystem when processing DMA_FROM_DEVICE calls. A local user can trigger a memory leak error and read random memory from the kernel space.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU63386

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-1011

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the write() function of FUSE filesystem. A local user can retireve (partial) /etc/shadow hashes and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Out-of-bounds write

EUVDB-ID: #VU62027

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-1015

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the nft_validate_register_store and nft_validate_register_load in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. A local user can escalate privileges on the system.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Use-after-free

EUVDB-ID: #VU62028

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1016

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in net/netfilter/nf_tables_core.c:nft_do_chain in Linux kernel.. A local user can trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU63428

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1048

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to a use-after-free error in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. A local user can execute arbitrary code with elevated privileges and perform a denial-of-service attack.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Release of invalid pointer or reference

EUVDB-ID: #VU63315

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24958

CWE-ID: CWE-763 - Release of invalid pointer or reference

Exploit availability: No

Description

The vulnerability allows remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to release of illegal memory vulnerability in the drivers/usb/gadget/legacy/inode.c. A remote attacker can send specially crafted data and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU62601

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26490

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the st21nfca_connectivity_event_received() function in drivers/nfc/st21nfca/se.c in Linux kernel. A local user can run a specially crafted program to trigger buffer overflow and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU63318

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26966

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in drivers/net/usb/sr9700.c in the Linux kernel. A remote attacker can pass specially crafted data and obtain sensitive information from heap memory.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper Validation of Array Index

EUVDB-ID: #VU63316

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27223

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code with elevated privileges.

The vulnerability exists due to improper validation of array index in drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel. A remote attacker can send specially crafted data to the system and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU63390

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28356

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in net/llc/af_llc.c component. A remote attacker can force the system to leak memory and perform denial of service attack.

Mitigation

Update the affected package linux-oem-5.14 to the latest version.

Vulnerable software versions

Ubuntu: 20.04

linux-image-5.14.0-1033-oem (Ubuntu package): before 5.14.0-1033.36

linux-image-oem-20.04 (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04d (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04b (Ubuntu package): before 5.14.0.1033.30

linux-image-oem-20.04c (Ubuntu package): before 5.14.0.1033.30

External links

http://ubuntu.com/security/notices/USN-5381-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###