USN-6652-1

Vulnerability from osv_ubuntu – Published: 2024-02-23 20:20 – Updated: 2024-02-23 20:20 – Source website
VLAI
Summary
linux-azure vulnerabilities
Details

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the io_uring subsystem in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46862)

It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

It was discovered that the netfilter subsystem in the Linux kernel did not properly validate inner tunnel netlink attributes, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-5972)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

Jann Horn discovered that a race condition existed in the Linux kernel when handling io_uring over sockets, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6531)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6915)

Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0565)

Jann Horn discovered that the io_uring subsystem in the Linux kernel did not properly handle the release of certain buffer rings. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0582)

It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2024-0641)

Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "linux-azure-cloud-tools-6.5.0-1015",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-azure-headers-6.5.0-1015",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-azure-tools-6.5.0-1015",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-buildinfo-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-cloud-tools-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-headers-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-image-unsigned-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-image-unsigned-6.5.0-1015-azure-dbgsym",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-modules-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-modules-extra-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-modules-ipu6-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-modules-ivsc-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-modules-iwlwifi-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          },
          {
            "binary_name": "linux-tools-6.5.0-1015-azure",
            "binary_version": "6.5.0-1015.15"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:23.10",
        "name": "linux-azure",
        "purl": "pkg:deb/ubuntu/linux-azure@6.5.0-1015.15?arch=source\u0026distro=mantic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.0-1015.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.2.0-1003.3",
        "6.2.0-1004.4",
        "6.5.0-1004.4",
        "6.5.0-1006.6",
        "6.5.0-1007.7",
        "6.5.0-1008.8",
        "6.5.0-1009.9",
        "6.5.0-1010.10",
        "6.5.0-1011.11"
      ]
    }
  ],
  "aliases": [],
  "details": "Marek Marczykowski-G\u00f3recki discovered that the Xen event channel\ninfrastructure implementation in the Linux kernel contained a race\ncondition. An attacker in a guest VM could possibly use this to cause a\ndenial of service (paravirtualized device unavailability). (CVE-2023-34324)\n\nZheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver\nin the Linux kernel during device removal. A privileged attacker could use\nthis to cause a denial of service (system crash). (CVE-2023-35827)\n\nTom Dohrmann discovered that the Secure Encrypted Virtualization (SEV)\nimplementation for AMD processors in the Linux kernel contained a race\ncondition when accessing MMIO registers. A local attacker in a SEV guest VM\ncould possibly use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2023-46813)\n\nIt was discovered that the io_uring subsystem in the Linux kernel contained\na race condition, leading to a null pointer dereference vulnerability. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2023-46862)\n\nIt was discovered that a race condition existed in the ATM (Asynchronous\nTransfer Mode) subsystem of the Linux kernel, leading to a use-after-free\nvulnerability. A local attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2023-51780)\n\nIt was discovered that a race condition existed in the AppleTalk networking\nsubsystem of the Linux kernel, leading to a use-after-free vulnerability. A\nlocal attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2023-51781)\n\nIt was discovered that the netfilter subsystem in the Linux kernel did not\nproperly validate inner tunnel netlink attributes, leading to a null\npointer dereference vulnerability. A local attacker could use this to cause\na denial of service (system crash). (CVE-2023-5972)\n\nIt was discovered that the TLS subsystem in the Linux kernel did not\nproperly perform cryptographic operations in some situations, leading to a\nnull pointer dereference vulnerability. A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2023-6176)\n\nJann Horn discovered that a race condition existed in the Linux kernel when\nhandling io_uring over sockets, leading to a use-after-free vulnerability.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2023-6531)\n\nXingyuan Mo discovered that the netfilter subsystem in the Linux kernel did\nnot properly handle dynset expressions passed from userspace, leading to a\nnull pointer dereference vulnerability. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2023-6622)\n\nZhenghan Wang discovered that the generic ID allocator implementation in\nthe Linux kernel did not properly check for null bitmap when releasing IDs.\nA local attacker could use this to cause a denial of service (system\ncrash). (CVE-2023-6915)\n\nRobert Morris discovered that the CIFS network file system implementation\nin the Linux kernel did not properly validate certain server commands\nfields, leading to an out-of-bounds read vulnerability. An attacker could\nuse this to cause a denial of service (system crash) or possibly expose\nsensitive information. (CVE-2024-0565)\n\nJann Horn discovered that the io_uring subsystem in the Linux kernel did\nnot properly handle the release of certain buffer rings. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2024-0582)\n\nIt was discovered that the TIPC protocol implementation in the Linux kernel\ndid not properly handle locking during tipc_crypto_key_revoke() operations.\nA local attacker could use this to cause a denial of service (kernel\ndeadlock). (CVE-2024-0641)\n\nJann Horn discovered that the TLS subsystem in the Linux kernel did not\nproperly handle spliced messages, leading to an out-of-bounds write\nvulnerability. A local attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2024-0646)\n\n",
  "id": "USN-6652-1",
  "modified": "2024-02-23T20:20:01.923714Z",
  "published": "2024-02-23T20:20:01.923714Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6652-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-5972"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6176"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6531"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6622"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6915"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-34324"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-35827"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-46813"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-46862"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-51780"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-51781"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-0565"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-0582"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-0641"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-0646"
    }
  ],
  "related": [
    "CVE-2023-5972",
    "UBUNTU-CVE-2023-5972",
    "CVE-2023-6176",
    "UBUNTU-CVE-2023-6176",
    "CVE-2023-6531",
    "UBUNTU-CVE-2023-6531",
    "CVE-2023-6622",
    "UBUNTU-CVE-2023-6622",
    "CVE-2023-6915",
    "UBUNTU-CVE-2023-6915",
    "CVE-2023-34324",
    "UBUNTU-CVE-2023-34324",
    "CVE-2023-35827",
    "UBUNTU-CVE-2023-35827",
    "CVE-2023-46813",
    "UBUNTU-CVE-2023-46813",
    "CVE-2023-46862",
    "UBUNTU-CVE-2023-46862",
    "CVE-2023-51780",
    "UBUNTU-CVE-2023-51780",
    "CVE-2023-51781",
    "UBUNTU-CVE-2023-51781",
    "CVE-2024-0565",
    "UBUNTU-CVE-2024-0565",
    "CVE-2024-0582",
    "UBUNTU-CVE-2024-0582",
    "CVE-2024-0641",
    "UBUNTU-CVE-2024-0641",
    "CVE-2024-0646",
    "UBUNTU-CVE-2024-0646"
  ],
  "schema_version": "1.6.3",
  "summary": "linux-azure vulnerabilities"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.