First published: Thu Aug 17 2023(Updated: )
It was discovered that the netlink implementation in the Linux kernel did not properly validate policies when parsing attributes in some situations. An attacker could use this to cause a denial of service (infinite recursion). (CVE-2020-36691) Billy Jheng Bing Jhong discovered that the CIFS network file system implementation in the Linux kernel did not properly validate arguments to ioctl() in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0168) It was discovered that the ext4 file system implementation in the Linux kernel contained a use-after-free vulnerability. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2022-1184) It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. (CVE-2022-27672) William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-4269) It was discovered that a race condition existed in the qdisc implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-0590) It was discovered that a race condition existed in the btrfs file system implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1611) It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855) It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990) It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124) It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2194) It was discovered that a race condition existed in the TLS subsystem in the Linux kernel, leading to a use-after-free or a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-28466) It was discovered that the DA9150 charger driver in the Linux kernel did not properly handle device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-30772) It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle error conditions in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-3111) It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141) It was discovered that the Qualcomm EMAC ethernet driver in the Linux kernel did not properly handle device removal, leading to a user-after free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-33203)
Affected Software | Affected Version | How to fix |
---|---|---|
All of | ||
ubuntu/linux-image-5.4.0-1027-xilinx-zynqmp | <5.4.0-1027.31 | 5.4.0-1027.31 |
=20.04 | ||
All of | ||
ubuntu/linux-image-xilinx-zynqmp | <5.4.0.1027.29 | 5.4.0.1027.29 |
=20.04 | ||
All of | ||
ubuntu/linux-image-5.4.0-156-generic | <5.4.0-156.173~18.04.1 | 5.4.0-156.173~18.04.1 |
=18.04 | ||
All of | ||
ubuntu/linux-image-5.4.0-156-generic-lpae | <5.4.0-156.173~18.04.1 | 5.4.0-156.173~18.04.1 |
=18.04 | ||
All of | ||
ubuntu/linux-image-5.4.0-156-lowlatency | <5.4.0-156.173~18.04.1 | 5.4.0-156.173~18.04.1 |
=18.04 | ||
All of | ||
ubuntu/linux-image-generic-hwe-18.04 | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 | ||
All of | ||
ubuntu/linux-image-generic-lpae-hwe-18.04 | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 | ||
All of | ||
ubuntu/linux-image-lowlatency-hwe-18.04 | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 | ||
All of | ||
ubuntu/linux-image-oem | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 | ||
All of | ||
ubuntu/linux-image-oem-osp1 | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 | ||
All of | ||
ubuntu/linux-image-snapdragon-hwe-18.04 | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 | ||
All of | ||
ubuntu/linux-image-virtual-hwe-18.04 | <5.4.0.156.173~18.04.126 | 5.4.0.156.173~18.04.126 |
=18.04 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Contains the following vulnerabilities)
The severity of USN-6301-1 is not specified in the provided information.
To fix USN-6301-1, update your Linux kernel to version 5.4.0-1027.31 or later.
CVE-2020-36691 can be exploited by an attacker to cause a denial of service (infinite recursion) on the affected system.
Ubuntu versions 20.04 and 18.04 are affected by USN-6301-1.
You can find more information about USN-6301-1 on the Ubuntu Security website.