UBUNTU-CVE-2023-6610: High severity ubuntu/linux vulnerability

Q: Which Ubuntu kernel packages are identified as affected?

The listed affected software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.

Q: What level of access does an attacker need?

The vulnerability is described as exploitable by a local attacker. The supplied severity vector indicates no privileges are required, but user interaction is required.

Q: What could successful exploitation do?

Successful exploitation could crash the system, affecting availability, or leak internal kernel information.

Published Dec 8, 2023

Updated

An out-of-bounds read vulnerability was found in smb2dumpdetail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

Affected Software

172 affected componentsFixes available

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-azure-5.15<5.15.0-1078.87~20.04.1

5.15.0-1078.87~20.04.1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5<6.5.0-1017.17~22.04.2

6.5.0-1017.17~22.04.2

ubuntu/linux-azure<5.15.0-1075.84

5.15.0-1075.84

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5<6.5.0-1018.19~22.04.2

6.5.0-1018.19~22.04.2

ubuntu/linux-azure-fde<5.15.0-1076.85.1

5.15.0-1076.85.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5<6.5.0-1017.17~22.04.1

6.5.0-1017.17~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5<6.5.0-27.28~22.04.1

6.5.0-27.28~22.04.1

ubuntu/linux-ibm*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5<6.5.0-27.28.1~22.04.1

6.5.0-27.28.1~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5<6.5.0-1014.14

6.5.0-1014.14

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1<6.1.0-1035.35

6.1.0-1035.35

ubuntu/linux-oem-6.5<6.5.0-1019.20

6.5.0-1019.20

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5<6.5.0-1020.20~22.04.1

6.5.0-1020.20~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5<6.5.0-27.28.1~22.04.1

6.5.0-27.28.1~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5<6.5.0-1011.12~22.04.1

6.5.0-1011.12~22.04.1

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips<5.15.0-1075.84+fips1

5.15.0-1075.84+fips1

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-raspi<6.7.0-1001.1

6.7.0-1001.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1078.87~20.04.1
Upgrade
Upgrade ubuntu/linux-aws-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1017.17~22.04.2
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.84
Upgrade
Upgrade ubuntu/linux-azure-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1018.19~22.04.2
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.85.1
Upgrade
Upgrade ubuntu/linux-gcp-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1017.17~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-27.28~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-27.28.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1014.14
Upgrade
Upgrade ubuntu/linux-oem-6.1 to a version that resolves this vulnerability.
Fixed in 6.1.0-1035.35
Upgrade
Upgrade ubuntu/linux-oem-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1019.20
Upgrade
Upgrade ubuntu/linux-oracle-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1020.20~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-27.28.1~22.04.1
Upgrade
Upgrade ubuntu/linux-starfive-6.5 to a version that resolves this vulnerability.
Fixed in 6.5.0-1011.12~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.84+fips1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.7.0-1001.1

Event History

Dec 8, 2023

CVE Published

via OSV·05:15 PM

Data Sourced

via OSV·05:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

The listed affected software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.

What level of access does an attacker need?

The vulnerability is described as exploitable by a local attacker. The supplied severity vector indicates no privileges are required, but user interaction is required.

What could successful exploitation do?

Successful exploitation could crash the system, affecting availability, or leak internal kernel information.

UBUNTU-CVE-2023-6610: High severity ubuntu/linux vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What level of access does an attacker need?

What could successful exploitation do?

Company

Resources

Contact