First published: Thu Oct 19 2023(Updated: )
It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206) Yu Hao and Weiteng Chen discovered that the Bluetooth HCI UART driver in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-31083) Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code. (CVE-2023-34319) Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a null pointer dereference vulnerability in some situations. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-3772) Kyle Zeng discovered that the networking stack implementation in the Linux kernel did not properly validate skb object size in certain conditions. An attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-42752) Kyle Zeng discovered that the netfiler subsystem in the Linux kernel did not properly calculate array offsets, leading to a out-of-bounds write vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-42753) Kyle Zeng discovered that the IPv4 Resource Reservation Protocol (RSVP) classifier implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash). Please note that kernel packet classifier support for RSVP has been removed to resolve this vulnerability. (CVE-2023-42755) Bing-Jhong Billy Jheng discovered that the Unix domain socket implementation in the Linux kernel contained a race condition in certain situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4622) Budimir Markovic discovered that the qdisc implementation in the Linux kernel did not properly validate inner classes, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4623) Alex Birnberg discovered that the netfilter subsystem in the Linux kernel did not properly validate register length, leading to an out-of- bounds write vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-4881) It was discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel did not properly handle network packets in certain conditions, leading to a use after free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4921)
Affected Software | Affected Version | How to fix |
---|---|---|
All of | ||
ubuntu/linux-image-4.4.0-1125-kvm | <4.4.0-1125.135 | 4.4.0-1125.135 |
=16.04 | ||
All of | ||
ubuntu/linux-image-4.4.0-1162-aws | <4.4.0-1162.177 | 4.4.0-1162.177 |
=16.04 | ||
All of | ||
ubuntu/linux-image-4.4.0-246-generic | <4.4.0-246.280 | 4.4.0-246.280 |
=16.04 | ||
All of | ||
ubuntu/linux-image-4.4.0-246-lowlatency | <4.4.0-246.280 | 4.4.0-246.280 |
=16.04 | ||
All of | ||
ubuntu/linux-image-aws | <4.4.0.1162.166 | 4.4.0.1162.166 |
=16.04 | ||
All of | ||
ubuntu/linux-image-generic | <4.4.0.246.252 | 4.4.0.246.252 |
=16.04 | ||
All of | ||
ubuntu/linux-image-generic-lts-xenial | <4.4.0.246.252 | 4.4.0.246.252 |
=16.04 | ||
All of | ||
ubuntu/linux-image-kvm | <4.4.0.1125.122 | 4.4.0.1125.122 |
=16.04 | ||
All of | ||
ubuntu/linux-image-lowlatency | <4.4.0.246.252 | 4.4.0.246.252 |
=16.04 | ||
All of | ||
ubuntu/linux-image-lowlatency-lts-xenial | <4.4.0.246.252 | 4.4.0.246.252 |
=16.04 | ||
All of | ||
ubuntu/linux-image-virtual | <4.4.0.246.252 | 4.4.0.246.252 |
=16.04 | ||
All of | ||
ubuntu/linux-image-virtual-lts-xenial | <4.4.0.246.252 | 4.4.0.246.252 |
=16.04 | ||
All of | ||
ubuntu/linux-image-4.4.0-246-generic | <4.4.0-246.280~14.04.1 | 4.4.0-246.280~14.04.1 |
=14.04 | ||
All of | ||
ubuntu/linux-image-4.4.0-246-lowlatency | <4.4.0-246.280~14.04.1 | 4.4.0-246.280~14.04.1 |
=14.04 | ||
All of | ||
ubuntu/linux-image-generic-lts-xenial | <4.4.0.246.214 | 4.4.0.246.214 |
=14.04 | ||
All of | ||
ubuntu/linux-image-lowlatency-lts-xenial | <4.4.0.246.214 | 4.4.0.246.214 |
=14.04 | ||
All of | ||
ubuntu/linux-image-virtual-lts-xenial | <4.4.0.246.214 | 4.4.0.246.214 |
=14.04 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Contains the following vulnerabilities)
The severity of CVE-2023-1206 is high.
A remote attacker can exploit CVE-2023-1206 by causing a denial of service through excessive CPU consumption.
Linux kernel versions 4.4.0-1125.135, 4.4.0-1162.177, 4.4.0-246.280, 4.4.0-246.280~14.04.1, 4.4.0.1162.166, 4.4.0.246.252, and 4.4.0-246.280~14.04.1 are affected by CVE-2023-1206.
To fix the vulnerability in CVE-2023-1206, update your Linux kernel to version 4.4.0-1125.136, 4.4.0-1162.178, 4.4.0-246.281, 4.4.0-246.281~14.04.2, 4.4.0.1162.167, 4.4.0.246.253, or 4.4.0-246.281~14.04.2.
You can find more information about CVE-2023-1206 at the following links: [link1](https://ubuntu.com/security/CVE-2023-31083), [link2](https://ubuntu.com/security/CVE-2023-42753), [link3](https://ubuntu.com/security/CVE-2023-4921).