USN-5358-2

Description

linux-aws-5.4, linux-aws-5.13, linux-azure, linux-azure-5.4, linux-azure-fde, linux-gcp, linux-gcp-5.13, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-ibm, linux-ibm-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities It was discovered that the network traffic control implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1055) It was discovered that the IPsec implementation in the Linux kernel did not properly allocate enough memory when performing ESP transformations, leading to a heap-based buffer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-27666)

Affected Systems

• ubuntu•linux-aws-5.13

  < 5.13.0-1021.23~20.04.2

• ubuntu•linux-aws-5.4

  < 5.4.0-1071.76~18.04.1

• ubuntu•linux-azure-5.4

  < 5.4.0-1074.77~18.04.1

• ubuntu•linux-azure-fde

  < 5.4.0-1074.77+cvm1.1

• ubuntu•linux-gcp

  < 5.4.0-1069.73

• ubuntu•linux-gcp-5.13

  < 5.13.0-1023.28~20.04.1

• ubuntu•linux-gcp-5.4

  < 5.4.0-1069.73~18.04.1

• ubuntu•linux-gke

  < 5.4.0-1067.70

• ubuntu•linux-gke-5.4

  < 5.4.0-1067.70~18.04.1

• ubuntu•linux-gkeop

  < 5.4.0-1038.39

• ubuntu•linux-gkeop-5.4

  < 5.4.0-1038.39~18.04.1

• ubuntu•linux-ibm

  < 5.4.0-1019.21

• ubuntu•linux-ibm-5.4

  < 5.4.0-1019.21~18.04.1

• ubuntu•linux-raspi

  < 5.4.0-1058.65

• ubuntu•linux-raspi-5.4

  < 5.4.0-1058.65~18.04.1

References (3)

• https://ubuntu.com/security/notices/USN-5358-2
• https://ubuntu.com/security/CVE-2022-1055
• https://ubuntu.com/security/CVE-2022-27666