Ubuntu update for linux



Published: 2024-04-22
Risk Medium
Patch available YES
Number of vulnerabilities 15
CVE-ID CVE-2023-1382
CVE-2023-1838
CVE-2023-1998
CVE-2023-24023
CVE-2023-51043
CVE-2023-51779
CVE-2023-52429
CVE-2024-23851
CVE-2023-6915
CVE-2024-0639
CVE-2023-52603
CVE-2023-52464
CVE-2023-52600
CVE-2023-52445
CVE-2023-52451
CWE-ID CWE-476
CWE-416
CWE-254
CWE-451
CWE-754
CWE-125
CWE-667
CWE-129
CWE-787
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe 		Ubuntu
Operating systems & Components / Operating system

linux-image-4.15.0-224-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-224-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1176-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1167-aws (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1161-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1151-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-4.15.0-1130-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oracle-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gcp-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-azure-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws-lts-18.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-kvm (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gcp (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-gke (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-azure (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-aws-hwe (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-generic-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-lowlatency-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oem (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-virtual-hwe-16.04 (Ubuntu package)
Operating systems & Components / Operating system package or component

linux-image-oracle (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 15 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU74550

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1382

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in net/tipc/topsrv.c within the TIPC protocol implementation in the Linux kernel. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU75205

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1838

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the vhost_net_set_backend() function in drivers/vhost/net.c. A local user can trigger a use-after-free error and crash the kernel.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security features bypass

EUVDB-ID: #VU75454

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1998

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of the Spectre v2 SMT mitigations, related to calling prctl with PR_SET_SPECULATION_CTRL. An attacker can gain unauthorized access to kernel memory from userspace.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Spoofing attack

EUVDB-ID: #VU83116

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-24023

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in Bluetooth. A remote attacker can spoof page content.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Use-after-free

EUVDB-ID: #VU86268

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51043

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in drivers/gpu/drm/drm_atomic.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU85023

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51779

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error when handling bt_sock_ioctl in the Bluetooth subsystem. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper Check for Unusual or Exceptional Conditions

EUVDB-ID: #VU87166

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52429

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the dm_table_create() function in drivers/md/dm-table.c. A local user can pass specially crafted data to the kernel and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU87595

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-23851

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the copy_params() function in drivers/md/dm-ioctl.c. A remote attacker can trigger an out-of-bounds read and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU85423

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6915

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the ida_free() function in lib/idr.c. A local user can pass specially crafted data to the system and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper locking

EUVDB-ID: #VU88894

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0639

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to improper locking within the sctp_auto_asconf_init() function in net/sctp/socket.c. A local user can crash the kernel.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper validation of array index

EUVDB-ID: #VU88885

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52603

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of array index within the dtSplitRoot() function in fs/jfs/jfs_dtree.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds write

EUVDB-ID: #VU88895

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52464

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the thunderx_ocx_com_threaded_isr() function in drivers/edac/thunderx_edac.c. A local user can trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU88104

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52600

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in fs/jfs/jfs_mount.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use-after-free

EUVDB-ID: #VU87745

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52445

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in pvrusb2. A local user can execute arbitrary code with elevated privileges.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds read

EUVDB-ID: #VU88891

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52451

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the dlpar_memory_remove_by_index() function in arch/powerpc/platforms/pseries/hotplug-memory.c. A local user can trigger an out-of-bounds read and perform a denial of service (DoS) attack.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 18.04

linux-image-4.15.0-224-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-224-generic (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1176-azure (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1167-aws (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1161-gcp (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1151-kvm (Ubuntu package): before Ubuntu Pro

linux-image-4.15.0-1130-oracle (Ubuntu package): before Ubuntu Pro

linux-image-oracle-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-gcp-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-azure-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-aws-lts-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-lowlatency (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-kvm (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gcp (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-gke (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-aws-hwe (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-generic-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-lowlatency-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oem (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-virtual-hwe-16.04 (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-6740-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###