USN-7332-2: linux-kvm vulnerabilities
Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - Block layer subsystem; - GPIO subsystem; - GPU drivers; - Media drivers; - Network drivers; - SCSI subsystem; - Direct Digital Synthesis drivers; - TTY drivers; - 9P distributed file system; - JFS file system; - NILFS2 file system; - File systems infrastructure; - BPF subsystem; - Netfilter; - Network sockets; - Memory management; - Amateur Radio drivers; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - Networking core; - IPv4 networking; - IPv6 networking; - Netlink; - TIPC protocol; - Wireless networking; - ALSA framework; (CVE-2024-26685, CVE-2024-50233, CVE-2024-41063, CVE-2024-42070, CVE-2024-40910, CVE-2024-40911, CVE-2024-36886, CVE-2024-35896, CVE-2024-43863, CVE-2023-52522, CVE-2024-53156, CVE-2023-52488, CVE-2024-43854, CVE-2024-44938, CVE-2024-53104, CVE-2024-44931, CVE-2024-50171, CVE-2024-43892, CVE-2024-50148, CVE-2024-38567, CVE-2024-36964, CVE-2024-43893, CVE-2024-36952, CVE-2022-48994, CVE-2021-47606, CVE-2023-52818, CVE-2024-41064, CVE-2024-40981, CVE-2024-40943, CVE-2024-42068, CVE-2023-52880, CVE-2021-47103, CVE-2024-43900, CVE-2024-50117, CVE-2023-52799, CVE-2024-49902)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 4.4.0-1142.153 - Upgrade
Upgrade
ubuntu/linux-image-4.4.0-1142-kvmto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/linux-image-kvmto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-7332-2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
- CVE-2021-47103
- CVE-2021-47606
- CVE-2022-48994
- CVE-2023-52488
- CVE-2023-52522
- CVE-2023-52799
- CVE-2023-52818
- CVE-2023-52880
- CVE-2024-26685
- CVE-2024-35896
- CVE-2024-36886
- CVE-2024-36952
- CVE-2024-36964
- CVE-2024-38567
- CVE-2024-40910
- CVE-2024-40911
- CVE-2024-40943
- CVE-2024-40981
- CVE-2024-41063
- CVE-2024-41064
- CVE-2024-42068
- CVE-2024-42070
- CVE-2024-43854
- CVE-2024-43863
- CVE-2024-43892
- CVE-2024-43893
- CVE-2024-43900
- CVE-2024-44931
- CVE-2024-44938
- CVE-2024-49902
- CVE-2024-50117
- CVE-2024-50148
- CVE-2024-50171
- CVE-2024-50233
- CVE-2024-53104
- CVE-2024-53156
- CVE-2025-0927
- UBUNTU-CVE-2021-47103
- UBUNTU-CVE-2021-47606
- UBUNTU-CVE-2022-48994
- UBUNTU-CVE-2023-52488
- UBUNTU-CVE-2023-52522
- UBUNTU-CVE-2023-52799
- UBUNTU-CVE-2023-52818
- UBUNTU-CVE-2023-52880
- UBUNTU-CVE-2024-26685
- UBUNTU-CVE-2024-35896
- UBUNTU-CVE-2024-36886
- UBUNTU-CVE-2024-36952
- UBUNTU-CVE-2024-36964
- UBUNTU-CVE-2024-38567
- UBUNTU-CVE-2024-40910
- UBUNTU-CVE-2024-40911
- UBUNTU-CVE-2024-40943
- UBUNTU-CVE-2024-40981
- UBUNTU-CVE-2024-41063
- UBUNTU-CVE-2024-41064
- UBUNTU-CVE-2024-42068
- UBUNTU-CVE-2024-42070
- UBUNTU-CVE-2024-43854
- UBUNTU-CVE-2024-43863
- UBUNTU-CVE-2024-43892
- UBUNTU-CVE-2024-43893
- UBUNTU-CVE-2024-43900
- UBUNTU-CVE-2024-44931
- UBUNTU-CVE-2024-44938
- UBUNTU-CVE-2024-49902
- UBUNTU-CVE-2024-50117
- UBUNTU-CVE-2024-50148
- UBUNTU-CVE-2024-50171
- UBUNTU-CVE-2024-50233
- UBUNTU-CVE-2024-53104
- UBUNTU-CVE-2024-53156
- UBUNTU-CVE-2025-0927
Frequently Asked Questions
What is the severity of USN-7332-2?
USN-7332-2 is considered a critical vulnerability due to its potential to cause system crashes and execute arbitrary code.
How do I fix USN-7332-2?
To fix USN-7332-2, update to the latest patched version of the affected packages: linux-image-4.4.0-1142-kvm or linux-image-kvm.
What systems are affected by USN-7332-2?
USN-7332-2 affects Ubuntu 16.04 users running specific versions of the kernel packages.
What type of vulnerability is USN-7332-2?
USN-7332-2 is a heap overflow vulnerability in the HFS+ file system implementation of the Linux Kernel.
Can USN-7332-2 lead to remote code execution?
Yes, USN-7332-2 has the potential to allow an attacker to execute arbitrary code through a specially crafted file system image.