USN-5540-1

Dashboard / Vulnerabilities / USN-5540-1

USN-5540-1

Summary: linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities

Details: Liu Jian discovered that the IGMP protocol implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20141) It was discovered that the USB gadget subsystem in the Linux kernel did not properly validate interface descriptor requests. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-25258) It was discovered that the Remote NDIS (RNDIS) USB gadget implementation in the Linux kernel did not properly validate the size of the RNDIS_MSG_SET command. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-25375) Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations. (CVE-2022-34918)

References: https://ubuntu.com/security/notices/USN-5540-1, https://ubuntu.com/security/CVE-2022-20141, https://ubuntu.com/security/CVE-2022-25258, https://ubuntu.com/security/CVE-2022-25375, https://ubuntu.com/security/CVE-2022-34918