USN-6220-1: Linux kernel vulnerabilities
Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35788, LP: #2023577) It was discovered that for some Intel processors the INVLPG instruction implementation did not properly flush global TLB entries when PCIDs are enabled. An attacker could use this to expose sensitive information (kernel memory) or possibly cause undesired behaviors. (LP: #2023220)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-gcpto a version that resolves this vulnerability.Fixed in 6.2.0.1008.8 - Upgrade
Upgrade
ubuntu/linux-image-ibmto a version that resolves this vulnerability.Fixed in 6.2.0.1004.4 - Upgrade
Upgrade
ubuntu/linux-image-azureto a version that resolves this vulnerability.Fixed in 6.2.0.1006.6 - Upgrade
Upgrade
ubuntu/linux-image-oracleto a version that resolves this vulnerability.Fixed in 6.2.0.1006.6 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1004-ibmto a version that resolves this vulnerability.Fixed in 6.2.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1006-oracleto a version that resolves this vulnerability.Fixed in 6.2.0-1006.6 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1006-azureto a version that resolves this vulnerability.Fixed in 6.2.0-1006.6 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1008-gcpto a version that resolves this vulnerability.Fixed in 6.2.0-1008.8 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch USN-6220-1
Event History
Frequently Asked Questions
What is the vulnerability ID of this USN?
CVE-2023-35788
What is the severity of CVE-2023-35788?
The severity of CVE-2023-35788 is not specified in the USN.
How can an attacker exploit CVE-2023-35788?
An attacker can exploit CVE-2023-35788 by using an out-of-bounds write vulnerability in the Flower classifier implementation in the Linux kernel.
What are the affected software versions for CVE-2023-35788?
The affected software versions for CVE-2023-35788 are Ubuntu 23.04 with the following Linux kernel packages: linux-image-gcp (6.2.0.1008.8), linux-image-ibm (6.2.0.1004.4), linux-image-azure (6.2.0.1006.6), linux-image-oracle (6.2.0.1006.6), linux-image-6.2.0-1004-ibm (6.2.0-1004.4), linux-image-6.2.0-1006-oracle (6.2.0-1006.6), linux-image-6.2.0-1006-azure (6.2.0-1006.6), and linux-image-6.2.0-1008-gcp (6.2.0-1008.8).
How do I fix the vulnerability in Ubuntu 23.04?
To fix the vulnerability in Ubuntu 23.04, update the Linux kernel packages to the recommended versions: linux-image-gcp (6.2.0.1008.8), linux-image-ibm (6.2.0.1004.4), linux-image-azure (6.2.0.1006.6), linux-image-oracle (6.2.0.1006.6), linux-image-6.2.0-1004-ibm (6.2.0-1004.4), linux-image-6.2.0-1006-oracle (6.2.0-1006.6), linux-image-6.2.0-1006-azure (6.2.0-1006.6), and linux-image-6.2.0-1008-gcp (6.2.0-1008.8).