usn-6013-1
Vulnerability from osv_ubuntu
Published
2023-04-12 14:41
Modified
2026-06-29 10:53
Summary
linux-aws vulnerabilities
Details

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-1016)

It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not handle detach events properly in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the tty subsystem in the Linux kernel contained a race condition in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2022-1462)

It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate link layer sessions properly. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1516)

Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1974)

Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context switches from occurring during certain atomic context operations. A privileged local attacker could use this to cause a denial of service (system crash). (CVE-2022-1975)

It was discovered that the HID subsystem in the Linux kernel did not properly validate inputs in certain conditions. A local attacker with physical access could plug in a specially crafted USB device to expose sensitive information. (CVE-2022-20132)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20572, CVE-2022-2503)

Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2318)

Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly handle very small reads. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2380)

David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

Lucas Leong discovered that the LightNVM subsystem in the Linux kernel did not properly handle data lengths in certain situations. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2991)

It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3061)

Jiasheng Jiang discovered that the wm8350 charger driver in the Linux kernel did not properly deallocate memory, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3111)

It was discovered that the sound subsystem in the Linux kernel contained a race condition in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform bounds checking in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3628)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)

It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly deallocate memory in certain error conditions. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2022-3646)

It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a reference counting error. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36879)

It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (memory exhaustion). (CVE-2022-3903)

Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41850)

It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset events. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (kernel deadlock). (CVE-2022-4662)

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)

Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2023-1095)

Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)

Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

References
https://ubuntu.com/security/notices/USN-6013-1 ADVISORY
https://ubuntu.com/security/CVE-2020-36516 REPORT
https://ubuntu.com/security/CVE-2021-3428 REPORT
https://ubuntu.com/security/CVE-2021-3659 REPORT
https://ubuntu.com/security/CVE-2021-3669 REPORT
https://ubuntu.com/security/CVE-2021-3732 REPORT
https://ubuntu.com/security/CVE-2021-3772 REPORT
https://ubuntu.com/security/CVE-2021-4149 REPORT
https://ubuntu.com/security/CVE-2021-4203 REPORT
https://ubuntu.com/security/CVE-2021-26401 REPORT
https://ubuntu.com/security/CVE-2021-28712 REPORT
https://ubuntu.com/security/CVE-2021-28713 REPORT
https://ubuntu.com/security/CVE-2021-45868 REPORT
https://ubuntu.com/security/CVE-2022-0487 REPORT
https://ubuntu.com/security/CVE-2022-0494 REPORT
https://ubuntu.com/security/CVE-2022-0617 REPORT
https://ubuntu.com/security/CVE-2022-1016 REPORT
https://ubuntu.com/security/CVE-2022-1195 REPORT
https://ubuntu.com/security/CVE-2022-1205 REPORT
https://ubuntu.com/security/CVE-2022-1462 REPORT
https://ubuntu.com/security/CVE-2022-1516 REPORT
https://ubuntu.com/security/CVE-2022-1974 REPORT
https://ubuntu.com/security/CVE-2022-1975 REPORT
https://ubuntu.com/security/CVE-2022-2318 REPORT
https://ubuntu.com/security/CVE-2022-2380 REPORT
https://ubuntu.com/security/CVE-2022-2503 REPORT
https://ubuntu.com/security/CVE-2022-2663 REPORT
https://ubuntu.com/security/CVE-2022-2991 REPORT
https://ubuntu.com/security/CVE-2022-3061 REPORT
https://ubuntu.com/security/CVE-2022-3111 REPORT
https://ubuntu.com/security/CVE-2022-3303 REPORT
https://ubuntu.com/security/CVE-2022-3628 REPORT
https://ubuntu.com/security/CVE-2022-3646 REPORT
https://ubuntu.com/security/CVE-2022-3903 REPORT
https://ubuntu.com/security/CVE-2022-4662 REPORT
https://ubuntu.com/security/CVE-2022-20132 REPORT
https://ubuntu.com/security/CVE-2022-20572 REPORT
https://ubuntu.com/security/CVE-2022-36280 REPORT
https://ubuntu.com/security/CVE-2022-36879 REPORT
https://ubuntu.com/security/CVE-2022-39188 REPORT
https://ubuntu.com/security/CVE-2022-41218 REPORT
https://ubuntu.com/security/CVE-2022-41849 REPORT
https://ubuntu.com/security/CVE-2022-41850 REPORT
https://ubuntu.com/security/CVE-2022-47929 REPORT
https://ubuntu.com/security/CVE-2023-0394 REPORT
https://ubuntu.com/security/CVE-2023-1074 REPORT
https://ubuntu.com/security/CVE-2023-1095 REPORT
https://ubuntu.com/security/CVE-2023-1118 REPORT
https://ubuntu.com/security/CVE-2023-23455 REPORT
https://ubuntu.com/security/CVE-2023-26545 REPORT
https://ubuntu.com/security/CVE-2023-26607 REPORT
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-36516",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3428",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3659",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3669",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3732",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-3772",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-4149",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-4203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-26401",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-28712",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-28713",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-45868",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-0487",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-0494",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-0617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1016",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1195",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1462",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1516",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1974",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1975",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-2318",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-2380",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-2503",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-2663",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-2991",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-3061",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-3111",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-3303",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-3628",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-3646",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-3903",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-4662",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-20132",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-20572",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-36280",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-36879",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-41218",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-41849",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-41850",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-47929",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-0394",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-1074",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-1095",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-1118",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-23455",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-26545",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-26607",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "linux-aws-cloud-tools-4.4.0-1117",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-aws-headers-4.4.0-1117",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-aws-tools-4.4.0-1117",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-buildinfo-4.4.0-1117-aws",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-cloud-tools-4.4.0-1117-aws",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-headers-4.4.0-1117-aws",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-image-4.4.0-1117-aws",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-modules-4.4.0-1117-aws",
            "binary_version": "4.4.0-1117.123"
          },
          {
            "binary_name": "linux-tools-4.4.0-1117-aws",
            "binary_version": "4.4.0-1117.123"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "linux-aws",
        "purl": "pkg:deb/ubuntu/linux-aws@4.4.0-1117.123?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-1117.123"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.0-1002.2",
        "4.4.0-1003.3",
        "4.4.0-1005.5",
        "4.4.0-1006.6",
        "4.4.0-1009.9",
        "4.4.0-1010.10",
        "4.4.0-1011.11",
        "4.4.0-1012.12",
        "4.4.0-1014.14",
        "4.4.0-1016.16",
        "4.4.0-1017.17",
        "4.4.0-1019.19",
        "4.4.0-1022.22",
        "4.4.0-1023.23",
        "4.4.0-1024.25",
        "4.4.0-1025.26",
        "4.4.0-1027.30",
        "4.4.0-1028.31",
        "4.4.0-1029.32",
        "4.4.0-1031.34",
        "4.4.0-1032.35",
        "4.4.0-1034.37",
        "4.4.0-1036.39",
        "4.4.0-1037.40",
        "4.4.0-1038.41",
        "4.4.0-1039.42",
        "4.4.0-1040.43",
        "4.4.0-1042.45",
        "4.4.0-1044.47",
        "4.4.0-1045.48",
        "4.4.0-1046.50",
        "4.4.0-1048.52",
        "4.4.0-1050.54",
        "4.4.0-1052.56",
        "4.4.0-1054.58",
        "4.4.0-1055.59",
        "4.4.0-1056.60",
        "4.4.0-1058.62",
        "4.4.0-1059.63",
        "4.4.0-1060.64",
        "4.4.0-1061.65",
        "4.4.0-1062.66",
        "4.4.0-1064.68",
        "4.4.0-1065.69",
        "4.4.0-1066.70",
        "4.4.0-1067.71",
        "4.4.0-1073.77",
        "4.4.0-1074.78",
        "4.4.0-1075.79",
        "4.4.0-1076.80",
        "4.4.0-1077.81",
        "4.4.0-1078.82",
        "4.4.0-1081.85",
        "4.4.0-1082.86",
        "4.4.0-1083.87",
        "4.4.0-1085.89",
        "4.4.0-1086.90",
        "4.4.0-1087.91",
        "4.4.0-1088.92",
        "4.4.0-1090.94",
        "4.4.0-1091.95",
        "4.4.0-1092.96",
        "4.4.0-1093.97",
        "4.4.0-1094.99",
        "4.4.0-1095.100",
        "4.4.0-1096.101",
        "4.4.0-1097.102",
        "4.4.0-1098.103",
        "4.4.0-1099.104",
        "4.4.0-1101.106",
        "4.4.0-1102.107",
        "4.4.0-1103.108",
        "4.4.0-1104.109",
        "4.4.0-1107.113",
        "4.4.0-1109.115",
        "4.4.0-1110.116",
        "4.4.0-1111.117",
        "4.4.0-1112.118",
        "4.4.0-1113.119",
        "4.4.0-1114.120",
        "4.4.0-1115.121",
        "4.4.0-1116.122"
      ]
    }
  ],
  "aliases": [],
  "details": "Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP\nimplementation in the Linux kernel did not properly handle IPID assignment.\nA remote attacker could use this to cause a denial of service (connection\ntermination) or inject forged data. (CVE-2020-36516)\n\nKe Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk,\nLisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre\nVariant 2 mitigations for AMD processors on Linux were insufficient in some\nsituations. A local attacker could possibly use this to expose sensitive\ninformation. (CVE-2021-26401)\n\nJ\u00fcrgen Gro\u00df discovered that the Xen subsystem within the Linux kernel did\nnot adequately limit the number of events driver domains (unprivileged PV\nbackends) could send to other guest VMs. An attacker in a driver domain\ncould use this to cause a denial of service in other guest VMs.\n(CVE-2021-28712, CVE-2021-28713)\n\nWolfgang Frisch discovered that the ext4 file system implementation in the\nLinux kernel contained an integer overflow when handling metadata inode\nextents. An attacker could use this to construct a malicious ext4 file\nsystem image that, when mounted, could cause a denial of service (system\ncrash). (CVE-2021-3428)\n\nIt was discovered that the IEEE 802.15.4 wireless network subsystem in the\nLinux kernel did not properly handle certain error conditions, leading to a\nnull pointer dereference vulnerability. A local attacker could possibly use\nthis to cause a denial of service (system crash). (CVE-2021-3659)\n\nIt was discovered that the System V IPC implementation in the Linux kernel\ndid not properly handle large shared memory counts. A local attacker could\nuse this to cause a denial of service (memory exhaustion). (CVE-2021-3669)\n\nAlois Wohlschlager discovered that the overlay file system in the Linux\nkernel did not restrict private clones in some situations. An attacker\ncould use this to expose sensitive information. (CVE-2021-3732)\n\nIt was discovered that the SCTP protocol implementation in the Linux kernel\ndid not properly verify VTAGs in some situations. A remote attacker could\npossibly use this to cause a denial of service (connection disassociation).\n(CVE-2021-3772)\n\nIt was discovered that the btrfs file system implementation in the Linux\nkernel did not properly handle locking in certain error conditions. A local\nattacker could use this to cause a denial of service (kernel deadlock).\n(CVE-2021-4149)\n\nJann Horn discovered that the socket subsystem in the Linux kernel\ncontained a race condition when handling listen() and connect() operations,\nleading to a read-after-free vulnerability. A local attacker could use this\nto cause a denial of service (system crash) or possibly expose sensitive\ninformation. (CVE-2021-4203)\n\nIt was discovered that the file system quotas implementation in the Linux\nkernel did not properly validate the quota block number. An attacker could\nuse this to construct a malicious file system image that, when mounted and\noperated on, could cause a denial of service (system crash).\n(CVE-2021-45868)\n\nZhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did\nnot properly handle device removal, leading to a use-after-free\nvulnerability. A physically proximate attacker could possibly use this to\ncause a denial of service (system crash). (CVE-2022-0487)\n\nIt was discovered that the block layer subsystem in the Linux kernel did\nnot properly initialize memory in some situations. A privileged local\nattacker could use this to expose sensitive information (kernel memory).\n(CVE-2022-0494)\n\nIt was discovered that the UDF file system implementation in the Linux\nkernel could attempt to dereference a null pointer in some situations. An\nattacker could use this to construct a malicious UDF image that, when\nmounted and operated on, could cause a denial of service (system crash).\n(CVE-2022-0617)\n\nDavid Bouman discovered that the netfilter subsystem in the Linux kernel\ndid not initialize memory in some situations. A local attacker could use\nthis to expose sensitive information (kernel memory). (CVE-2022-1016)\n\nIt was discovered that the implementation of the 6pack and mkiss protocols\nin the Linux kernel did not handle detach events properly in some\nsituations, leading to a use-after-free vulnerability. A local attacker\ncould possibly use this to cause a denial of service (system crash).\n(CVE-2022-1195)\n\nDuoming Zhou discovered race conditions in the AX.25 amateur radio protocol\nimplementation in the Linux kernel, leading to use-after-free\nvulnerabilities. A local attacker could possibly use this to cause a denial\nof service (system crash). (CVE-2022-1205)\n\nIt was discovered that the tty subsystem in the Linux kernel contained a\nrace condition in certain situations, leading to an out-of-bounds read\nvulnerability. A local attacker could possibly use this to cause a denial\nof service (system crash) or expose sensitive information. (CVE-2022-1462)\n\nIt was discovered that the implementation of X.25 network protocols in the\nLinux kernel did not terminate link layer sessions properly. A local\nattacker could possibly use this to cause a denial of service (system\ncrash). (CVE-2022-1516)\n\nDuoming Zhou discovered a race condition in the NFC subsystem in the Linux\nkernel, leading to a use-after-free vulnerability. A privileged local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2022-1974)\n\nDuoming Zhou discovered that the NFC subsystem in the Linux kernel did not\nproperly prevent context switches from occurring during certain atomic\ncontext operations. A privileged local attacker could use this to cause a\ndenial of service (system crash). (CVE-2022-1975)\n\nIt was discovered that the HID subsystem in the Linux kernel did not\nproperly validate inputs in certain conditions. A local attacker with\nphysical access could plug in a specially crafted USB device to expose\nsensitive information. (CVE-2022-20132)\n\nIt was discovered that the device-mapper verity (dm-verity) driver in the\nLinux kernel did not properly verify targets being loaded into the device-\nmapper table. A privileged attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2022-20572,\nCVE-2022-2503)\n\nDuoming Zhou discovered that race conditions existed in the timer handling\nimplementation of the Linux kernel\u0027s Rose X.25 protocol layer, resulting in\nuse-after-free vulnerabilities. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2022-2318)\n\nZheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the\nLinux kernel did not properly handle very small reads. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2022-2380)\n\nDavid Leadbeater discovered that the netfilter IRC protocol tracking\nimplementation in the Linux Kernel incorrectly handled certain message\npayloads in some situations. A remote attacker could possibly use this to\ncause a denial of service or bypass firewall filtering. (CVE-2022-2663)\n\nLucas Leong discovered that the LightNVM subsystem in the Linux kernel did\nnot properly handle data lengths in certain situations. A privileged\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2022-2991)\n\nIt was discovered that the Intel 740 frame buffer driver in the Linux\nkernel contained a divide by zero vulnerability. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2022-3061)\n\nJiasheng Jiang discovered that the wm8350 charger driver in the Linux\nkernel did not properly deallocate memory, leading to a null pointer\ndereference vulnerability. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2022-3111)\n\nIt was discovered that the sound subsystem in the Linux kernel contained a\nrace condition in some situations. A local attacker could use this to cause\na denial of service (system crash). (CVE-2022-3303)\n\nIt was discovered that the Broadcom FullMAC USB WiFi driver in the Linux\nkernel did not properly perform bounds checking in some situations. A\nphysically proximate attacker could use this to craft a malicious USB\ndevice that when inserted, could cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2022-3628)\n\nZiming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux\nkernel contained an out-of-bounds write vulnerability. A local attacker\ncould use this to cause a denial of service (system crash).\n(CVE-2022-36280)\n\nIt was discovered that the NILFS2 file system implementation in the Linux\nkernel did not properly deallocate memory in certain error conditions. An\nattacker could use this to cause a denial of service (memory exhaustion).\n(CVE-2022-3646)\n\nIt was discovered that the Netlink Transformation (XFRM) subsystem in the\nLinux kernel contained a reference counting error. A local attacker could\nuse this to cause a denial of service (system crash). (CVE-2022-36879)\n\nIt was discovered that the infrared transceiver USB driver did not properly\nhandle USB control messages. A local attacker with physical access could\nplug in a specially crafted USB device to cause a denial of service (memory\nexhaustion). (CVE-2022-3903)\n\nJann Horn discovered a race condition existed in the Linux kernel when\nunmapping VMAs in certain situations, resulting in possible use-after-free\nvulnerabilities. A local attacker could possibly use this to cause a denial\nof service (system crash) or execute arbitrary code. (CVE-2022-39188)\n\nHyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not\nproperly perform reference counting in some situations, leading to a use-\nafter-free vulnerability. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2022-41218)\n\nIt was discovered that a race condition existed in the SMSC UFX USB driver\nimplementation in the Linux kernel, leading to a use-after-free\nvulnerability. A physically proximate attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2022-41849)\n\nIt was discovered that a race condition existed in the Roccat HID driver in\nthe Linux kernel, leading to a use-after-free vulnerability. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2022-41850)\n\nIt was discovered that the USB core subsystem in the Linux kernel did not\nproperly handle nested reset events. A local attacker with physical access\ncould plug in a specially crafted USB device to cause a denial of service\n(kernel deadlock). (CVE-2022-4662)\n\nIt was discovered that the network queuing discipline implementation in the\nLinux kernel contained a null pointer dereference in some situations. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2022-47929)\n\nKyle Zeng discovered that the IPv6 implementation in the Linux kernel\ncontained a NULL pointer dereference vulnerability in certain situations. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2023-0394)\n\nIt was discovered that a memory leak existed in the SCTP protocol\nimplementation in the Linux kernel. A local attacker could use this to\ncause a denial of service (memory exhaustion). (CVE-2023-1074)\n\nMingi Cho discovered that the netfilter subsystem in the Linux kernel did\nnot properly initialize a data structure, leading to a null pointer\ndereference vulnerability. An attacker could use this to cause a denial of\nservice (system crash). (CVE-2023-1095)\n\nKyle Zeng discovered that the ATM VC queuing discipline implementation in\nthe Linux kernel contained a type confusion vulnerability in some\nsituations. An attacker could use this to cause a denial of service (system\ncrash). (CVE-2023-23455)\n\nLianhui Tang discovered that the MPLS implementation in the Linux kernel\ndid not properly handle certain sysctl allocation failure conditions,\nleading to a double-free vulnerability. An attacker could use this to cause\na denial of service or possibly execute arbitrary code. (CVE-2023-26545)\n\nIt was discovered that the NTFS file system implementation in the Linux\nkernel did not properly validate attributes in certain situations, leading\nto an out-of-bounds read vulnerability. A local attacker could possibly use\nthis to expose sensitive information (kernel memory). (CVE-2023-26607)\n\nDuoming Zhou discovered that a race condition existed in the infrared\nreceiver/transceiver driver in the Linux kernel, leading to a use-after-\nfree vulnerability. A privileged attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2023-1118)\n\n",
  "id": "USN-6013-1",
  "modified": "2026-06-29T10:53:01Z",
  "published": "2023-04-12T14:41:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6013-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-36516"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3428"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3659"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3669"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3732"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3772"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-4149"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-4203"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-26401"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-28712"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-28713"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-45868"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-0487"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-0494"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-0617"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1016"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1195"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1205"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1462"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1516"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1974"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1975"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-2318"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-2380"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-2503"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-2663"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-2991"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-3061"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-3111"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-3303"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-3628"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-3646"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-3903"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-4662"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-20132"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-20572"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-36280"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-36879"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-39188"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-41218"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-41849"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-41850"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-47929"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-0394"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-1074"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-1095"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-1118"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-23455"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-26545"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-26607"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "linux-aws vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2020-36516",
    "UBUNTU-CVE-2021-3428",
    "UBUNTU-CVE-2021-3659",
    "UBUNTU-CVE-2021-3669",
    "UBUNTU-CVE-2021-3732",
    "UBUNTU-CVE-2021-3772",
    "UBUNTU-CVE-2021-4149",
    "UBUNTU-CVE-2021-4203",
    "UBUNTU-CVE-2021-26401",
    "UBUNTU-CVE-2021-28712",
    "UBUNTU-CVE-2021-28713",
    "UBUNTU-CVE-2021-45868",
    "UBUNTU-CVE-2022-0487",
    "UBUNTU-CVE-2022-0494",
    "UBUNTU-CVE-2022-0617",
    "UBUNTU-CVE-2022-1016",
    "UBUNTU-CVE-2022-1195",
    "UBUNTU-CVE-2022-1205",
    "UBUNTU-CVE-2022-1462",
    "UBUNTU-CVE-2022-1516",
    "UBUNTU-CVE-2022-1974",
    "UBUNTU-CVE-2022-1975",
    "UBUNTU-CVE-2022-2318",
    "UBUNTU-CVE-2022-2380",
    "UBUNTU-CVE-2022-2503",
    "UBUNTU-CVE-2022-2663",
    "UBUNTU-CVE-2022-2991",
    "UBUNTU-CVE-2022-3061",
    "UBUNTU-CVE-2022-3111",
    "UBUNTU-CVE-2022-3303",
    "UBUNTU-CVE-2022-3628",
    "UBUNTU-CVE-2022-3646",
    "UBUNTU-CVE-2022-3903",
    "UBUNTU-CVE-2022-4662",
    "UBUNTU-CVE-2022-20132",
    "UBUNTU-CVE-2022-20572",
    "UBUNTU-CVE-2022-36280",
    "UBUNTU-CVE-2022-36879",
    "UBUNTU-CVE-2022-39188",
    "UBUNTU-CVE-2022-41218",
    "UBUNTU-CVE-2022-41849",
    "UBUNTU-CVE-2022-41850",
    "UBUNTU-CVE-2022-47929",
    "UBUNTU-CVE-2023-0394",
    "UBUNTU-CVE-2023-1074",
    "UBUNTU-CVE-2023-1095",
    "UBUNTU-CVE-2023-1118",
    "UBUNTU-CVE-2023-23455",
    "UBUNTU-CVE-2023-26545",
    "UBUNTU-CVE-2023-26607"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.