USN-5357-2

Advisory lineage Upstream: 2 Downstream: 0
Published: 31 Mar 2022, 22:14
Last modified:29 Jun 2026, 13:49

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

31 Mar 2022, 22:14
Published
Vulnerability first disclosed
29 Jun 2026, 13:49
Last Modified
Vulnerability information updated

Description

linux-aws-hwe, linux-azure, linux-gcp, linux-gcp-4.15, linux-oracle, linux-raspi2 vulnerability It was discovered that the IPsec implementation in the Linux kernel did not properly allocate enough memory when performing ESP transformations, leading to a heap-based buffer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Affected Systems

  • ubuntu•linux-aws-hwe

    < 4.15.0-1126.135~16.04.2

  • ubuntu•linux-azure

    < 4.15.0-1136.149~14.04.1 | < 4.15.0-1136.149~14.04.1 | < 4.15.0-1136.149~16.04.1

  • ubuntu•linux-gcp

    < 4.15.0-1120.134~16.04.1

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1120.134

  • ubuntu•linux-oracle

    < 4.15.0-1091.100~16.04.1 | < 4.15.0-1091.100

  • ubuntu•linux-raspi2

    < 4.15.0-1107.114

References (2)