UBUNTU-CVE-2024-50099: High severity ubuntu/linux-azure vulnerability

Published Nov 5, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulateldrliteral() and simulateldrswliteral() functions are unsafe to use for uprobes. Both functions were originally written for use with kprobes, and access memory with plain C accesses. When uprobes was added, these were reused unmodified even though they cannot safely access user memory. There are three key problems: 1) The plain C accesses do not have corresponding extable entries, and thus if they encounter a fault the kernel will treat these as unintentional accesses to user memory, resulting in a BUG() which will kill the kernel thread, and likely lead to further issues (e.g. lockup or panic()). 2) The plain C accesses are subject to HW PAN and SW PAN, and so when either is in use, any attempt to simulate an access to user memory will fault. Thus neither simulateldrliteral() nor simulateldrswliteral() can do anything useful when simulating a user instruction on any system with HW PAN or SW PAN. 3) The plain C accesses are privileged, as they run in kernel context, and in practice can access a small range of kernel virtual addresses. The instructions they simulate have a range of +/-1MiB, and since the simulated instructions must itself be a user instructions in the TTBR0 address range, these can address the final 1MiB of the TTBR1 acddress range by wrapping downwards from an address in the first 1MiB of the TTBR0 address range. In contemporary kernels the last 8MiB of TTBR1 address range is reserved, and accesses to this will always fault, meaning this is no worse than (1). Historically, it was theoretically possible for the linear map or vmemmap to spill into the final 8MiB of the TTBR1 address range, but in practice this is extremely unlikely to occur as this would require either: Having enough physical memory to fill the entire linear map all the way to the final 1MiB of the TTBR1 address range. Getting unlucky with KASLR randomization of the linear map such that the populated region happens to overlap with the last 1MiB of the TTBR address range. ... and in either case if we were to spill into the final page there would be larger problems as the final page would alias with error pointers. Practically speaking, (1) and (2) are the big issues. Given there have been no reports of problems since the broken code was introduced, it appears that no-one is relying on probing these instructions with uprobes. Avoid these issues by not allowing uprobes on LDR (literal) and LDRSW (literal), limiting the use of simulateldrliteral() and simulateldrswliteral() to kprobes. Attempts to place uprobes on LDR (literal) and LDRSW (literal) will be rejected as armprobedecodeinsn() will return INSNREJECTED. In future we can consider introducing working uprobes support for these instructions, but this will require more significant work.

Affected Software

196 affected componentsFixes available
ubuntu/linux-azure*
ubuntu/linux-aws-hwe*
ubuntu/linux-azure*
ubuntu/linux-gcp*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oracle*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4<5.4.0-1142.152~18.04.1
5.4.0-1142.152~18.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-4.15*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4<5.4.0-1145.152~18.04.1
5.4.0-1145.152~18.04.1
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4<5.4.0-1143.152~18.04.1
5.4.0-1143.152~18.04.1
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4<5.4.0-208.228~18.04.1
5.4.0-208.228~18.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4<5.4.0-1086.91~18.04.1
5.4.0-1086.91~18.04.1
ubuntu/linux-kvm*
ubuntu/linux-oem*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4<5.4.0-1138.147~18.04.1
5.4.0-1138.147~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1129.142~18.04.1
5.4.0-1129.142~18.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-208.228
5.4.0-208.228
ubuntu/linux-aws<5.4.0-1140.150
5.4.0-1140.150
ubuntu/linux-aws-5.15<5.15.0-1080.87~20.04.1
5.15.0-1080.87~20.04.1
ubuntu/linux-azure<5.4.0-1145.152
5.4.0-1145.152
ubuntu/linux-azure-5.15<5.15.0-1081.90~20.04.1
5.15.0-1081.90~20.04.1
ubuntu/linux-bluefield<5.4.0-1099.106
5.4.0-1099.106
ubuntu/linux-gcp<5.4.0-1143.152
5.4.0-1143.152
ubuntu/linux-gcp-5.15<5.15.0-1077.86~20.04.1
5.15.0-1077.86~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-134.145~20.04.1
5.15.0-134.145~20.04.1
ubuntu/linux-ibm<5.4.0-1086.91
5.4.0-1086.91
ubuntu/linux-ibm-5.15<5.15.0-1074.77~20.04.1
5.15.0-1074.77~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1073.79~20.04.2
5.15.0-1073.79~20.04.2
ubuntu/linux-iot<5.4.0-1048.51
5.4.0-1048.51
ubuntu/linux-kvm<5.4.0-1127.136
5.4.0-1127.136
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-133.143~20.04.1
5.15.0-133.143~20.04.1
ubuntu/linux-oracle<5.4.0-1138.147
5.4.0-1138.147
ubuntu/linux-oracle-5.15<5.15.0-1075.81~20.04.1
5.15.0-1075.81~20.04.1
ubuntu/linux-raspi<5.4.0-1129.142
5.4.0-1129.142
ubuntu/linux-riscv-5.15<5.15.0-1073.77~20.04.1
5.15.0-1073.77~20.04.1
ubuntu/linux-xilinx-zynqmp<5.4.0-1058.62
5.4.0-1058.62
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1
5.15.0-1039.39~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1140.151+fips1
5.4.0-1140.151+fips1
ubuntu/linux-azure-fips<5.4.0-1145.152+fips1
5.4.0-1145.152+fips1
ubuntu/linux-fips<5.4.0-1116.126
5.4.0-1116.126
ubuntu/linux-gcp-fips<5.4.0-1143.152+fips1
5.4.0-1143.152+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-133.144
5.15.0-133.144
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1078.85
5.15.0-1078.85
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1027.29~22.04.1
6.8.0-1027.29~22.04.1
ubuntu/linux-azure<5.15.0-1081.90
5.15.0-1081.90
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1025.30~22.04.1
6.8.0-1025.30~22.04.1
ubuntu/linux-azure-fde<5.15.0-1081.90.1
5.15.0-1081.90.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1077.86
5.15.0-1077.86
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1026.28~22.04.1
6.8.0-1026.28~22.04.1
ubuntu/linux-gke<5.15.0-1075.81
5.15.0-1075.81
ubuntu/linux-gkeop<5.15.0-1060.68
5.15.0-1060.68
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-57.59~22.04.1
6.8.0-57.59~22.04.1
ubuntu/linux-ibm<5.15.0-1070.73
5.15.0-1070.73
ubuntu/linux-ibm-6.8<6.8.0-1023.23~22.04.1
6.8.0-1023.23~22.04.1
ubuntu/linux-intel-iotg<5.15.0-1073.79
5.15.0-1073.79
ubuntu/linux-kvm<5.15.0-1076.81
5.15.0-1076.81
ubuntu/linux-lowlatency<5.15.0-133.143
5.15.0-133.143
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-56.58.1~22.04.1
6.8.0-56.58.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1072.73
5.15.0-1072.73
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1024.27~22.04.1
6.8.0-1024.27~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1033.33
5.15.0-1033.33
ubuntu/linux-nvidia-tegra-igx<5.15.0-1021.21
5.15.0-1021.21
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1075.81
5.15.0-1075.81
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1022.23~22.04.1
6.8.0-1022.23~22.04.1
ubuntu/linux-raspi<5.15.0-1072.75
5.15.0-1072.75
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-56.58.1~22.04.1
6.8.0-56.58.1~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1044.48
5.15.0-1044.48
ubuntu/linux-bluefield<5.15.0-1060.62
5.15.0-1060.62
ubuntu/linux-intel-iot-realtime<5.15.0-1071.73
5.15.0-1071.73
ubuntu/linux-realtime<5.15.0-1078.86
5.15.0-1078.86
ubuntu/linux-realtime-6.8<6.8.1-1018.19~22.04.1
6.8.1-1018.19~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1078.85+fips1
5.15.0-1078.85+fips1
ubuntu/linux-azure-fips<5.15.0-1080.89+fips1
5.15.0-1080.89+fips1
ubuntu/linux-fips<5.15.0-133.144+fips1
5.15.0-133.144+fips1
ubuntu/linux-gcp-fips<5.15.0-1077.86+fips1
5.15.0-1077.86+fips1
ubuntu/linux<6.8.0-56.58
6.8.0-56.58
ubuntu/linux-aws<6.8.0-1025.27
6.8.0-1025.27
ubuntu/linux-azure<6.8.0-1025.30
6.8.0-1025.30
ubuntu/linux-azure-6.11<6.11.0-1012.12~24.04.1
6.11.0-1012.12~24.04.1
ubuntu/linux-azure-nvidia<6.8.0-1014.15
6.8.0-1014.15
ubuntu/linux-gcp<6.8.0-1026.28
6.8.0-1026.28
ubuntu/linux-gcp-6.11<6.11.0-1011.11~24.04.1
6.11.0-1011.11~24.04.1
ubuntu/linux-gke<6.8.0-1021.25
6.8.0-1021.25
ubuntu/linux-gkeop<6.8.0-1008.10
6.8.0-1008.10
ubuntu/linux-ibm<6.8.0-1022.22
6.8.0-1022.22
ubuntu/linux-lowlatency<6.8.0-56.58.1
6.8.0-56.58.1
ubuntu/linux-nvidia<6.8.0-1024.27
6.8.0-1024.27
ubuntu/linux-nvidia-6.11<6.11.0-1007.7
6.11.0-1007.7
ubuntu/linux-nvidia-lowlatency<6.8.0-1024.27.1
6.8.0-1024.27.1
ubuntu/linux-nvidia-tegra<6.8.0-1004.4
6.8.0-1004.4
ubuntu/linux-oem-6.11<6.11.0-1015.15
6.11.0-1015.15
ubuntu/linux-oem-6.8<6.8.0-1024.24
6.8.0-1024.24
ubuntu/linux-oracle<6.8.0-1022.23
6.8.0-1022.23
ubuntu/linux-raspi<6.8.0-1028.32
6.8.0-1028.32
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv<6.8.0-56.58.1
6.8.0-56.58.1
ubuntu/linux-xilinx<6.8.0-1017.18
6.8.0-1017.18
ubuntu/linux-raspi-realtime<6.8.0-2023.24
6.8.0-2023.24
ubuntu/linux-realtime<6.8.1-1018.19
6.8.1-1018.19
ubuntu/linux-fips<6.8.0-78.78+fips1
6.8.0-78.78+fips1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.152~18.04.1
  2. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.152~18.04.1
  3. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1143.152~18.04.1
  4. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-208.228~18.04.1
  5. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1086.91~18.04.1
  6. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1138.147~18.04.1
  7. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.142~18.04.1
  8. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-208.228
  9. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1140.150
  10. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.152
  12. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1081.90~20.04.1
  13. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1099.106
  14. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1143.152
  15. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.86~20.04.1
  16. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-134.145~20.04.1
  17. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1086.91
  18. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.77~20.04.1
  19. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1073.79~20.04.2
  20. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1048.51
  21. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1127.136
  22. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-133.143~20.04.1
  23. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1138.147
  24. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.81~20.04.1
  25. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.142
  26. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1073.77~20.04.1
  27. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1058.62
  28. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.39~20.04.1
  29. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1140.151+fips1
  30. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.152+fips1
  31. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1116.126
  32. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1143.152+fips1
  33. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-133.144
  34. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1078.85
  35. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1027.29~22.04.1
  36. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1081.90
  37. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1025.30~22.04.1
  38. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1081.90.1
  39. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.86
  40. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.28~22.04.1
  41. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.81
  42. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1060.68
  43. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-57.59~22.04.1
  44. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1070.73
  45. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1023.23~22.04.1
  46. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1073.79
  47. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1076.81
  48. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-133.143
  49. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-56.58.1~22.04.1
  50. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1072.73
  51. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.27~22.04.1
  52. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1033.33
  53. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1021.21
  54. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.81
  55. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1022.23~22.04.1
  56. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1072.75
  57. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-56.58.1~22.04.1
  58. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1044.48
  59. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1060.62
  60. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1071.73
  61. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1078.86
  62. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1018.19~22.04.1
  63. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1078.85+fips1
  64. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.89+fips1
  65. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-133.144+fips1
  66. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.86+fips1
  67. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-56.58
  68. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1025.27
  69. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1025.30
  70. Upgrade

    Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1012.12~24.04.1
  71. Upgrade

    Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1014.15
  72. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.28
  73. Upgrade

    Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1011.11~24.04.1
  74. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1021.25
  75. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.10
  76. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1022.22
  77. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-56.58.1
  78. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.27
  79. Upgrade

    Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1007.7
  80. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.27.1
  81. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1004.4
  82. Upgrade

    Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1015.15
  83. Upgrade

    Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1024.24
  84. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1022.23
  85. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.32
  86. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.8.0-56.58.1
  87. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.18
  88. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2023.24
  89. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1018.19
  90. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-78.78+fips1
  91. Compensating control

    Do not allow uprobes on AArch64 LDR (literal) and LDRSW (literal) instructions; restrict simulate_ldr_literal() and simulate_ldrsw_literal() to kprobes.

Event History

Nov 5, 2024
CVE Published
via OSV·06:15 PM
Data Sourced
via OSV·06:15 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

Which systems are exposed to this issue?

The affected software list includes Ubuntu kernel packages for standard, FIPS, Azure, AWS FIPS, Azure FIPS, GCP, GCP FIPS, and Oracle variants. The issue concerns arm64 uprobe handling.

2

What does an attacker need to trigger the vulnerability?

The supplied severity vector indicates local access, low attack complexity, low privileges, and no user interaction. Exploitation involves the unsafe simulation of literal-load instructions through uprobes.

3

What is the likely impact of successful exploitation?

Unsafe accesses can fault without appropriate exception-table handling, causing a kernel BUG and potentially a kernel-thread death, lockup, or panic. The provided vector rates availability impact as high, with no confidentiality or integrity impact.

4

Are systems with PAN protections unaffected?

No. The description states that hardware PAN or software PAN causes these plain kernel-context accesses to user memory to fault, so the affected simulation functions cannot safely operate under either protection.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203