USN-7392-3: Linux kernel (AWS) vulnerabilities
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848) Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7392-3?
The severity of USN-7392-3 is considered high due to the use-after-free vulnerability that can lead to denial of service or arbitrary code execution.
How do I fix USN-7392-3?
To fix USN-7392-3, upgrade to the appropriate patched version of the Linux kernel, such as linux-image-5.4.0-1142.152 for Ubuntu 20.04.
What causes the vulnerability in USN-7392-3?
The vulnerability in USN-7392-3 is caused by a use-after-free issue in the CEC driver of the Linux kernel.
Are my systems affected by USN-7392-3?
If you are using Ubuntu 20.04 with the specified versions of the Linux kernel, your systems are affected by USN-7392-3.
Is there a risk of remote exploitation with USN-7392-3?
The risk of remote exploitation with USN-7392-3 is low, as it primarily requires local access to trigger the vulnerability.