USN-7392-2: Linux kernel vulnerabilities
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848) Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7392-2?
The severity of USN-7392-2 is critical due to a use-after-free vulnerability that can lead to denial of service or arbitrary code execution.
How do I fix USN-7392-2?
To fix USN-7392-2, you should upgrade to the specified remedial packages for Ubuntu 20.04.
What software is affected by USN-7392-2?
USN-7392-2 affects various kernel packages including linux-image-5.4.0-1145-gcp-fips and linux-image-5.4.0-1147-azure-fips on Ubuntu 20.04.
Who discovered the vulnerability in USN-7392-2?
The vulnerability in USN-7392-2 was discovered by Chenyuan Yang and Attila Szász.
What types of attacks are possible due to USN-7392-2?
Due to USN-7392-2, a local attacker could cause a denial of service (system crash) or potentially execute arbitrary code.