Ubuntu update for linux

Published: 2024-07-04

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2022-0001 CVE-2024-2201 CVE-2024-26925 CVE-2024-26643
CWE-ID	CWE-200 CWE-1037 CWE-667 CWE-362
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software	Ubuntu Operating systems & Components / Operating system linux-image-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gkeop (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gcp-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-ibm-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-xilinx-zynqmp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi2 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem-osp1 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oem (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-gkeop-5.4 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-bluefield (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-aws-lts-20.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-187-lowlatency (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-187-generic-lpae (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-187-generic (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1132-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1131-gcp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1127-aws (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1126-oracle (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1115-kvm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1111-raspi (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1094-gkeop (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1087-bluefield (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1074-ibm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1046-xilinx-zynqmp (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-5.4.0-1039-iot (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-lowlatency-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-virtual-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-snapdragon-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-generic-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-raspi-hwe-18.04 (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-ibm (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-azure (Ubuntu package) Operating systems & Components / Operating system package or component linux-image-oracle (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU61198

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-0001

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to non-transparent sharing of branch predictor selectors between contexts. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package linux to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 20.04

linux-image-raspi (Ubuntu package): before 5.4.0.1111.141

linux-image-gkeop (Ubuntu package): before 5.4.0.1094.92

linux-image-gcp-lts-20.04 (Ubuntu package): before 5.4.0.1131.133

linux-image-ibm-lts-20.04 (Ubuntu package): before 5.4.0.1074.103

linux-image-xilinx-zynqmp (Ubuntu package): before 5.4.0.1046.46

linux-image-virtual (Ubuntu package): before 5.4.0.187.185

linux-image-raspi2 (Ubuntu package): before 5.4.0.1111.141

linux-image-oracle-lts-20.04 (Ubuntu package): before 5.4.0.1126.119

linux-image-oem-osp1 (Ubuntu package): before 5.4.0.187.185

linux-image-oem (Ubuntu package): before 5.4.0.187.185

linux-image-lowlatency (Ubuntu package): before 5.4.0.187.185

linux-image-kvm (Ubuntu package): before 5.4.0.1115.111

linux-image-gkeop-5.4 (Ubuntu package): before 5.4.0.1094.92

linux-image-generic-lpae (Ubuntu package): before 5.4.0.187.185

linux-image-generic (Ubuntu package): before 5.4.0.187.185

linux-image-bluefield (Ubuntu package): before 5.4.0.1087.83

linux-image-azure-lts-20.04 (Ubuntu package): before 5.4.0.1132.126

linux-image-aws-lts-20.04 (Ubuntu package): before 5.4.0.1127.124

linux-image-5.4.0-187-lowlatency (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-187-generic-lpae (Ubuntu package): before 5.4.0-187.207

linux-image-5.4.0-187-generic (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1132-azure (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1131-gcp (Ubuntu package): before 5.4.0-1131.140

linux-image-5.4.0-1127-aws (Ubuntu package): before 5.4.0-1127.137

linux-image-5.4.0-1126-oracle (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1115-kvm (Ubuntu package): before 5.4.0-1115.122

linux-image-5.4.0-1111-raspi (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1094-gkeop (Ubuntu package): before 5.4.0-1094.98

linux-image-5.4.0-1087-bluefield (Ubuntu package): before 5.4.0-1087.94

linux-image-5.4.0-1074-ibm (Ubuntu package): before Ubuntu Pro

linux-image-5.4.0-1046-xilinx-zynqmp (Ubuntu package): before 5.4.0-1046.50

linux-image-5.4.0-1039-iot (Ubuntu package): before 5.4.0-1039.40

linux-image-lowlatency-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-virtual-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-snapdragon-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-generic-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-raspi-hwe-18.04 (Ubuntu package): before Ubuntu Pro

linux-image-ibm (Ubuntu package): before Ubuntu Pro

linux-image-azure (Ubuntu package): before Ubuntu Pro (Infra-only)

linux-image-oracle (Ubuntu package): before Ubuntu Pro (Infra-only)

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6868-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Processor optimization removal or modification of security-critical code

EUVDB-ID: #VU88374

Risk: Medium

CVSSv4.0: 7.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Green]

CVE-ID: CVE-2024-2201

CWE-ID: CWE-1037 - Processor optimization removal or modification of security-critical code

Exploit availability: No

Description

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to native branch history injection on x86 systems. A malicious guest can infer the contents of arbitrary host memory, including memory assigned to other guests and compromise the affected system.