USN-6228-1: Linux kernel vulnerabilities
It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124) Wei Chen discovered that the InfiniBand RDMA communication manager implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-2176)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1007-oracleto a version that resolves this vulnerability.Fixed in 6.2.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-image-oracleto a version that resolves this vulnerability.Fixed in 6.2.0.1007.7 - Upgrade
Upgrade
ubuntu/linux-image-azureto a version that resolves this vulnerability.Fixed in 6.2.0.1007.7 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1007-azureto a version that resolves this vulnerability.Fixed in 6.2.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1009-gcpto a version that resolves this vulnerability.Fixed in 6.2.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-image-ibmto a version that resolves this vulnerability.Fixed in 6.2.0.1005.5 - Upgrade
Upgrade
ubuntu/linux-image-6.2.0-1005-ibmto a version that resolves this vulnerability.Fixed in 6.2.0-1005.5 - Upgrade
Upgrade
ubuntu/linux-image-gcpto a version that resolves this vulnerability.Fixed in 6.2.0.1009.9
Event History
Frequently Asked Questions
What is the vulnerability ID for this Linux kernel vulnerability?
The vulnerability ID for this Linux kernel vulnerability is CVE-2023-2124.
How does this vulnerability impact the Linux kernel?
This vulnerability could cause a denial of service (system crash) when a specially crafted file system image is mounted.
What is the severity of CVE-2023-2124?
The severity of CVE-2023-2124 is not specified in the provided information.
Which software versions are affected by CVE-2023-2124?
The following software versions are affected by CVE-2023-2124: linux-image-6.2.0-1007-oracle, linux-image-oracle, linux-image-azure, linux-image-6.2.0-1007-azure, linux-image-6.2.0-1009-gcp, linux-image-ibm, linux-image-6.2.0-1005-ibm, linux-image-gcp.
How can I fix the vulnerability in the Linux kernel?
To fix the vulnerability, update the affected software versions to the recommended versions: linux-image-6.2.0-1007-oracle (6.2.0-1007.7), linux-image-oracle (6.2.0.1007.7), linux-image-azure (6.2.0.1007.7), linux-image-6.2.0-1007-azure (6.2.0-1007.7), linux-image-6.2.0-1009-gcp (6.2.0-1009.9), linux-image-ibm (6.2.0.1005.5), linux-image-6.2.0-1005-ibm (6.2.0-1005.5), linux-image-gcp (6.2.0.1009.9).