Headline
Ubuntu Security Notice USN-6047-1
Ubuntu Security Notice 6047-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed.
==========================================================================Ubuntu Security Notice USN-6047-1April 27, 2023linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-4.15,linux-azure-5.4, linux-gcp, linux-gcp-4.15, linux-gcp-5.4, linux-gke,linux-gkeop, linux-hwe, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle,linux-oracle-5.4 vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTS- Ubuntu 18.04 LTS- Ubuntu 16.04 ESM- Ubuntu 14.04 ESMSummary:The system could be made to run programs as an administrator.Software Description:- linux: Linux kernel- linux-aws: Linux kernel for Amazon Web Services (AWS) systems- linux-azure: Linux kernel for Microsoft Azure Cloud systems- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems- linux-gke: Linux kernel for Google Container Engine (GKE) systems- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems- linux-ibm: Linux kernel for IBM cloud systems- linux-kvm: Linux kernel for cloud environments- linux-oracle: Linux kernel for Oracle Cloud systems- linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems- linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems- linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems- linux-gcp-5.4: Linux kernel for Google Cloud Platform (GCP) systems- linux-hwe-5.4: Linux hardware enablement (HWE) kernel- linux-oracle-5.4: Linux kernel for Oracle Cloud systems- linux-hwe: Linux hardware enablement (HWE) kernelDetails:It was discovered that the Traffic-Control Index (TCINDEX) implementationin the Linux kernel did not properly perform filter deactivation in somesituations. A local attacker could possibly use this to gain elevatedprivileges. Please note that with the fix for this CVE, kernel support forthe TCINDEX classifier has been removed.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS: linux-image-5.4.0-1048-ibm 5.4.0-1048.53 linux-image-5.4.0-1068-gkeop 5.4.0-1068.72 linux-image-5.4.0-1090-kvm 5.4.0-1090.96 linux-image-5.4.0-1098-gke 5.4.0-1098.105 linux-image-5.4.0-1100-oracle 5.4.0-1100.109 linux-image-5.4.0-1101-aws 5.4.0-1101.109 linux-image-5.4.0-1104-gcp 5.4.0-1104.113 linux-image-5.4.0-1107-azure 5.4.0-1107.113 linux-image-5.4.0-148-generic 5.4.0-148.165 linux-image-5.4.0-148-generic-lpae 5.4.0-148.165 linux-image-5.4.0-148-lowlatency 5.4.0-148.165 linux-image-aws-lts-20.04 5.4.0.1101.98 linux-image-azure-lts-20.04 5.4.0.1107.100 linux-image-gcp-lts-20.04 5.4.0.1104.106 linux-image-generic 5.4.0.148.146 linux-image-generic-hwe-18.04 5.4.0.148.146 linux-image-generic-hwe-18.04-edge 5.4.0.148.146 linux-image-generic-lpae 5.4.0.148.146 linux-image-generic-lpae-hwe-18.04 5.4.0.148.146 linux-image-generic-lpae-hwe-18.04-edge 5.4.0.148.146 linux-image-gke 5.4.0.1098.103 linux-image-gke-5.4 5.4.0.1098.103 linux-image-gkeop 5.4.0.1068.66 linux-image-gkeop-5.4 5.4.0.1068.66 linux-image-ibm 5.4.0.1048.74 linux-image-ibm-lts-20.04 5.4.0.1048.74 linux-image-kvm 5.4.0.1090.84 linux-image-lowlatency 5.4.0.148.146 linux-image-oem 5.4.0.148.146 linux-image-oem-osp1 5.4.0.148.146 linux-image-oracle-lts-20.04 5.4.0.1100.93 linux-image-virtual 5.4.0.148.146Ubuntu 18.04 LTS: linux-image-4.15.0-1118-oracle 4.15.0-1118.129 linux-image-4.15.0-1139-kvm 4.15.0-1139.144 linux-image-4.15.0-1149-gcp 4.15.0-1149.165 linux-image-4.15.0-1164-azure 4.15.0-1164.179 linux-image-4.15.0-210-generic 4.15.0-210.221 linux-image-4.15.0-210-generic-lpae 4.15.0-210.221 linux-image-4.15.0-210-lowlatency 4.15.0-210.221 linux-image-5.4.0-1100-oracle 5.4.0-1100.109~18.04.1 linux-image-5.4.0-1101-aws 5.4.0-1101.109~18.04.1 linux-image-5.4.0-1104-gcp 5.4.0-1104.113~18.04.1 linux-image-5.4.0-1107-azure 5.4.0-1107.113~18.04.1 linux-image-5.4.0-148-generic 5.4.0-148.165~18.04.1 linux-image-5.4.0-148-generic-lpae 5.4.0-148.165~18.04.1 linux-image-5.4.0-148-lowlatency 5.4.0-148.165~18.04.1 linux-image-aws 5.4.0.1101.79 linux-image-azure 5.4.0.1107.80 linux-image-azure-lts-18.04 4.15.0.1164.132 linux-image-gcp 5.4.0.1104.80 linux-image-gcp-lts-18.04 4.15.0.1149.163 linux-image-generic 4.15.0.210.193 linux-image-generic-hwe-18.04 5.4.0.148.165~18.04.119 linux-image-generic-lpae 4.15.0.210.193 linux-image-generic-lpae-hwe-18.04 5.4.0.148.165~18.04.119 linux-image-kvm 4.15.0.1139.130 linux-image-lowlatency 4.15.0.210.193 linux-image-lowlatency-hwe-18.04 5.4.0.148.165~18.04.119 linux-image-oem 5.4.0.148.165~18.04.119 linux-image-oem-osp1 5.4.0.148.165~18.04.119 linux-image-oracle 5.4.0.1100.109~18.04.72 linux-image-oracle-lts-18.04 4.15.0.1118.123 linux-image-snapdragon-hwe-18.04 5.4.0.148.165~18.04.119 linux-image-virtual 4.15.0.210.193 linux-image-virtual-hwe-18.04 5.4.0.148.165~18.04.119Ubuntu 16.04 ESM: linux-image-4.15.0-1118-oracle 4.15.0-1118.129~16.04.1 linux-image-4.15.0-1149-gcp 4.15.0-1149.165~16.04.1 linux-image-4.15.0-1164-azure 4.15.0-1164.179~16.04.1 linux-image-4.15.0-210-generic 4.15.0-210.221~16.04.1 linux-image-4.15.0-210-lowlatency 4.15.0-210.221~16.04.1 linux-image-azure 4.15.0.1164.148 linux-image-gcp 4.15.0.1149.139 linux-image-generic-hwe-16.04 4.15.0.210.195 linux-image-gke 4.15.0.1149.139 linux-image-lowlatency-hwe-16.04 4.15.0.210.195 linux-image-oem 4.15.0.210.195 linux-image-oracle 4.15.0.1118.99 linux-image-virtual-hwe-16.04 4.15.0.210.195Ubuntu 14.04 ESM: linux-image-4.15.0-1164-azure 4.15.0-1164.179~14.04.1 linux-image-azure 4.15.0.1164.130After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References: https://ubuntu.com/security/notices/USN-6047-1 CVE-2023-1829Package Information: https://launchpad.net/ubuntu/+source/linux/5.4.0-148.165 https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1101.109 https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1107.113 https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1104.113 https://launchpad.net/ubuntu/+source/linux-gke/5.4.0-1098.105 https://launchpad.net/ubuntu/+source/linux-gkeop/5.4.0-1068.72 https://launchpad.net/ubuntu/+source/linux-ibm/5.4.0-1048.53 https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1090.96 https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1100.109 https://launchpad.net/ubuntu/+source/linux/4.15.0-210.221 https://launchpad.net/ubuntu/+source/linux-aws-5.4/5.4.0-1101.109~18.04.1 https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1164.179 https://launchpad.net/ubuntu/+source/linux-azure-5.4/5.4.0-1107.113~18.04.1 https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1149.165 https://launchpad.net/ubuntu/+source/linux-gcp-5.4/5.4.0-1104.113~18.04.1 https://launchpad.net/ubuntu/+source/linux-hwe-5.4/5.4.0-148.165~18.04.1 https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1139.144 https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1118.129 https://launchpad.net/ubuntu/+source/linux-oracle-5.4/5.4.0-1100.109~18.04.1
Related news
Red Hat Security Advisory 2023-7434-01 - An update for kernel is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Issues addressed include a use-after-free vulnerability.
Red Hat Security Advisory 2023-4962-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include out of bounds access, out of bounds write, and use-after-free vulnerabilities.
An update for kernel-rt is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-1829: A use-after-free vulnerability was found in the traffic control index filter (tcindex) in the Linux kernel. The tcindex_delete does not properly deactivate filters, which ...
An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42896: A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req functions. An attacker with physical access within the range of standard Bluetooth transmission could execute code l...
Red Hat Security Advisory 2023-4531-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include privilege escalation and use-after-free vulnerabilities.
Red Hat Security Advisory 2023-4541-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include out of bounds access, out of bounds write, privilege escalation, and use-after-free vulnerabilities.
An update for kpatch-patch is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42896: A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req functions. An attacker with physical access within the range of standard Bluetooth transmission could execute code leaking kernel memory via B...
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42896: A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req functions. An attacker with physical access within the range of standard Bluetooth transmission could execute code leaking kernel memory via Blue...
Ubuntu Security Notice 6222-1 - Jiasheng Jiang discovered that the HSA Linux kernel driver for AMD Radeon GPU devices did not properly validate memory allocation in certain situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service. Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a denial of service.
Ubuntu Security Notice 6134-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that the Traffic-Control Index implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6133-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information.
Ubuntu Security Notice 6093-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that the Traffic-Control Index implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6072-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. Lin Ma discovered a race condition in the io_uring subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service.
Ubuntu Security Notice 6071-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. Lin Ma discovered a race condition in the io_uring subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service.
Ubuntu Security Notice 6070-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6069-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed.
Ubuntu Security Notice 6058-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges.
Ubuntu Security Notice 6052-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for thisCVE, kernel support for the TCINDEX classifier has been removed.
Ubuntu Security Notice 6051-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for thisCVE, kernel support for the TCINDEX classifier has been removed. It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6045-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. Gwnaun Jung discovered that the SFB packet scheduling implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6044-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6043-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for thisCVE, kernel support for the TCINDEX classifier has been removed. It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.
Ubuntu Security Notice 6033-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for thisCVE, kernel support for the TCINDEX classifier has been removed. William Zhao discovered that the Traffic Control subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service.
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.