UBUNTU-CVE-2022-21505: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Which deployments are exposed to this issue?

Systems using IMA appraisal with the ima_appraise=log boot parameter are exposed when lockdown is used while Secure Boot is disabled or unavailable. Secure Boot prevents IMA from accepting that boot parameter.

Q: What access does an attacker need to exploit this?

Exploitation is local and requires high privileges, as reflected by the CVSS vector. The attacker uses kexec to defeat lockdown under the affected configuration.

Q: What can be done if an update cannot be applied immediately?

Do not use ima_appraise=log with lockdown on systems where Secure Boot is disabled or unavailable. Enabling Secure Boot prevents IMA from setting ima_appraise=log from the boot parameters.

Q: Which Ubuntu kernel package variants are listed as affected?

The listed packages are linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-ibm, and linux-kvm.

Published Jul 19, 2022

Updated

In the linux kernel, if IMA appraisal is used with the "imaappraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "imaappraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Affected Software

95 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.4<5.4.0-1086.93~18.04.1

5.4.0-1086.93~18.04.1

ubuntu/linux-azure-5.4<5.4.0-1094.100~18.04.1

5.4.0-1094.100~18.04.1

ubuntu/linux-gcp-5.4<5.4.0-1092.101~18.04.1

5.4.0-1092.101~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-128.144~18.04.1

5.4.0-128.144~18.04.1

ubuntu/linux-ibm-5.4<5.4.0-1034.38~18.04.1

5.4.0-1034.38~18.04.1

ubuntu/linux-oracle-5.4<5.4.0-1084.92~18.04.1

5.4.0-1084.92~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1071.81~18.04.1

5.4.0-1071.81~18.04.1

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux<5.4.0-128.144

5.4.0-128.144

ubuntu/linux-aws<5.4.0-1086.93

5.4.0-1086.93

ubuntu/linux-aws-5.15<5.15.0-1021.25~20.04.1

5.15.0-1021.25~20.04.1

ubuntu/linux-azure<5.4.0-1094.100

5.4.0-1094.100

ubuntu/linux-azure-5.15<5.15.0-1021.26~20.04.1

5.15.0-1021.26~20.04.1

ubuntu/linux-bluefield<5.4.0-1047.52

5.4.0-1047.52

ubuntu/linux-gcp<5.4.0-1090.98

5.4.0-1090.98

ubuntu/linux-gcp-5.15<5.15.0-1021.28~20.04.1

5.15.0-1021.28~20.04.1

ubuntu/linux-gke<5.4.0-1084.90

5.4.0-1084.90

ubuntu/linux-gke-5.15<5.15.0-1019.23~20.04.1

5.15.0-1019.23~20.04.1

ubuntu/linux-gkeop<5.4.0-1054.57

5.4.0-1054.57

ubuntu/linux-gkeop-5.15<5.15.0-1005.7~20.04.1

5.15.0-1005.7~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-50.56~20.04.1

5.15.0-50.56~20.04.1

ubuntu/linux-ibm<5.4.0-1034.38

5.4.0-1034.38

ubuntu/linux-intel-iotg-5.15<5.15.0-1017.22~20.04.1

5.15.0-1017.22~20.04.1

ubuntu/linux-iot<5.4.0-1005.7

5.4.0-1005.7

ubuntu/linux-kvm<5.4.0-1076.81

5.4.0-1076.81

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-50.56~20.04.1

5.15.0-50.56~20.04.1

ubuntu/linux-oracle<5.4.0-1084.92

5.4.0-1084.92

ubuntu/linux-oracle-5.15<5.15.0-1019.24~20.04.1

5.15.0-1019.24~20.04.1

ubuntu/linux-raspi<5.4.0-1071.81

5.4.0-1071.81

ubuntu/linux-riscv-5.15<5.15.0-1022.26~20.04.1

5.15.0-1022.26~20.04.1

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1086.93+fips1

5.4.0-1086.93+fips1

ubuntu/linux-azure-fips<5.4.0-1094.100+fips1

5.4.0-1094.100+fips1

ubuntu/linux-fips<5.4.0-1062.70

5.4.0-1062.70

ubuntu/linux-gcp-fips<5.4.0-1092.101+fips1

5.4.0-1092.101+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-50.56

5.15.0-50.56

ubuntu/linux-aws<5.15.0-1021.25

5.15.0-1021.25

ubuntu/linux-azure<5.15.0-1021.26

5.15.0-1021.26

ubuntu/linux-azure-fde<5.15.0-1024.30.1

5.15.0-1024.30.1

ubuntu/linux-gcp<5.15.0-1019.25

5.15.0-1019.25

ubuntu/linux-gke<5.15.0-1017.20

5.15.0-1017.20

ubuntu/linux-gkeop<5.15.0-1004.6

5.15.0-1004.6

ubuntu/linux-ibm<5.15.0-1015.17

5.15.0-1015.17

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1017.22

5.15.0-1017.22

ubuntu/linux-kvm<5.15.0-1019.23

5.15.0-1019.23

ubuntu/linux-lowlatency<5.15.0-50.56

5.15.0-50.56

ubuntu/linux-nvidia<5.15.0-1015.15

5.15.0-1015.15

ubuntu/linux-oem-5.17<5.17.0-1030.31

5.17.0-1030.31

ubuntu/linux-oracle<5.15.0-1019.24

5.15.0-1019.24

ubuntu/linux-raspi<5.15.0-1016.18

5.15.0-1016.18

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-realtime<5.15.0-1022.22

5.15.0-1022.22

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1086.93~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.100~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1092.101~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-128.144~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1034.38~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1084.92~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1071.81~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-128.144
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1086.93
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.25~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.100
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.26~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1047.52
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1090.98
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.28~20.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.4.0-1084.90
Upgrade
Upgrade ubuntu/linux-gke-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1019.23~20.04.1
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.57
Upgrade
Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1005.7~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-50.56~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1034.38
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.22~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1005.7
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1076.81
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-50.56~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1084.92
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1019.24~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1071.81
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.26~20.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1086.93+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1094.100+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1062.70
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1092.101+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-50.56
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.25
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.26
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1024.30.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1019.25
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.20
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1004.6
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1015.17
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.22
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1019.23
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-50.56
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1015.15
Upgrade
Upgrade ubuntu/linux-oem-5.17 to a version that resolves this vulnerability.
Fixed in 5.17.0-1030.31
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1019.24
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1016.18
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.22

Event History

Jul 19, 2022

CVE Published

via OSV·05:00 PM

Data Sourced

via OSV·05:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Systems using IMA appraisal with the ima_appraise=log boot parameter are exposed when lockdown is used while Secure Boot is disabled or unavailable. Secure Boot prevents IMA from accepting that boot parameter.

What access does an attacker need to exploit this?

Exploitation is local and requires high privileges, as reflected by the CVSS vector. The attacker uses kexec to defeat lockdown under the affected configuration.

What can be done if an update cannot be applied immediately?

Do not use ima_appraise=log with lockdown on systems where Secure Boot is disabled or unavailable. Enabling Secure Boot prevents IMA from setting ima_appraise=log from the boot parameters.

Which Ubuntu kernel package variants are listed as affected?

The listed packages are linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-ibm, and linux-kvm.

UBUNTU-CVE-2022-21505: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit this?

What can be done if an update cannot be applied immediately?

Which Ubuntu kernel package variants are listed as affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit this?

What can be done if an update cannot be applied immediately?

Which Ubuntu kernel package variants are listed as affected?