Detections
Analytics

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6025-1)

high Nessus Plugin ID 174450

Language:

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6025-1 advisory.

 - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. (CVE-2022-4129)

 - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in net/sched/sch_api.c. (CVE-2022-47929)

 - A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system. (CVE-2022-4842)

 - A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel's OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. (CVE-2023-0386)

 - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

 - A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2023-1073)

 - A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service. (CVE-2023-1074)

 - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use- after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

 - A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem. (CVE-2023-1652)

 - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

https://ubuntu.com/security/notices/USN-6025-1

Plugin Details

Severity: High

ID: 174450

File Name: ubuntu_USN-6025-1.nasl

Version: 1.4

Type: local

Agent: unix

Published: 4/19/2023

Updated: 1/9/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-1281

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1018-gkeop, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1027-raspi, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1027-raspi-nolpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1028-ibm, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1031-gke, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1031-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1032-gcp, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1033-oracle, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1034-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1036-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1036-azure-fde, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-70-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-70-generic-64k, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-70-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-70-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-70-lowlatency-64k

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/19/2023

Vulnerability Publication Date: 11/28/2022

Exploitable With

Core Impact

Reference Information

CVE: CVE-2022-4129, CVE-2022-47929, CVE-2022-4842, CVE-2023-0386, CVE-2023-0394, CVE-2023-1073, CVE-2023-1074, CVE-2023-1281, CVE-2023-1652, CVE-2023-26545

USN: 6025-1