Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
EUVDB-ID: #VU69708
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-3586
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in the way the sch_sfb enqueue function used the socket buffer (SKB) cb
field after the same SKB had been enqueued (and freed) into a child
qdisc. A local user can perform a denial of service (DoS) attack.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 16.04
linux-image-4.4.0-1118-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1119-kvm (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-generic (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1156-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-lowlatency (Ubuntu package): before Ubuntu Pro
linux-image-virtual-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-aws (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)
External linkshttp://ubuntu.com/security/notices/USN-6045-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU69805
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-4095
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the cmd_hdl_filter() function in drivers/staging/rtl8712/rtl8712_cmd.c. A local user can trigger a double free error and execute arbitrary code with escalated privileges.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 16.04
linux-image-4.4.0-1118-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1119-kvm (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-generic (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1156-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-lowlatency (Ubuntu package): before Ubuntu Pro
linux-image-virtual-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-aws (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)
External linkshttp://ubuntu.com/security/notices/USN-6045-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU74631
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-1390
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in tipc_link_xmit() within the Linux kernel TIPC kernel module when parsing UDp packets. A remote attacker can send two small UDP packets to a system with a UDP bearer and consume all available CPU resources.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 16.04
linux-image-4.4.0-1118-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1119-kvm (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-generic (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1156-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-lowlatency (Ubuntu package): before Ubuntu Pro
linux-image-virtual-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-aws (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)
External linkshttp://ubuntu.com/security/notices/USN-6045-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75450
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-1670
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the Xircom 16-bit PCMCIA (PC-card) Ethernet driver. A local user can trigger a use-after-free error and execute arbitrary code on the system.
MitigationUpdate the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 16.04
linux-image-4.4.0-1118-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1119-kvm (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-generic (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1156-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-lowlatency (Ubuntu package): before Ubuntu Pro
linux-image-virtual-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-aws (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)
External linkshttp://ubuntu.com/security/notices/USN-6045-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75448
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-1829
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the tcindex_delete() function. A local user can trigger a use-after-free error and execute arbitrary code with root privileges.
Update the affected package linux to the latest version.
Vulnerable software versionsUbuntu: 14.04 - 16.04
linux-image-4.4.0-1118-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1119-kvm (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-generic (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-1156-aws (Ubuntu package): before Ubuntu Pro
linux-image-4.4.0-240-lowlatency (Ubuntu package): before Ubuntu Pro
linux-image-virtual-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic-lts-xenial (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-aws (Ubuntu package): before Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)
External linkshttp://ubuntu.com/security/notices/USN-6045-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.