Test ID:	1.3.6.1.4.1.25623.1.1.12.2022.5647.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5647-1)
Summary:	The remote host is missing an update for the 'linux-gcp' package(s) announced via the USN-5647-1 advisory.
Description:	Summary: The remote host is missing an update for the 'linux-gcp' package(s) announced via the USN-5647-1 advisory. Vulnerability Insight: It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655) Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012, CVE-2022-32296) Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729) It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503) Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did not properly handle rules that truncated packets below the packet header size. When such rules are in place, a remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-36946) Affected Software/OS: 'linux-gcp' package(s) on Ubuntu 20.04. Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-33655 Debian Security Information: DSA-5191 (Google Search) https://www.debian.org/security/2022/dsa-5191 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=086ff84617185393a0bbf25830c4f36412a7d3f4 https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html http://www.openwall.com/lists/oss-security/2022/07/19/2 Common Vulnerability Exposure (CVE) ID: CVE-2022-1012 https://bugzilla.redhat.com/show_bug.cgi?id=2064604 https://lore.kernel.org/lkml/20220427065233.2075-1-w@1wt.eu/T/ Common Vulnerability Exposure (CVE) ID: CVE-2022-1729 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704 https://www.openwall.com/lists/oss-security/2022/05/20/2 Common Vulnerability Exposure (CVE) ID: CVE-2022-2503 https://github.com/google/security-research/security/advisories/GHSA-6vq3-w69p-w63m Common Vulnerability Exposure (CVE) ID: CVE-2022-32296 Debian Security Information: DSA-5173 (Google Search) https://www.debian.org/security/2022/dsa-5173 https://arxiv.org/abs/2209.12993 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 https://github.com/0xkol/rfc6056-device-tracker https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html Common Vulnerability Exposure (CVE) ID: CVE-2022-36946 Debian Security Information: DSA-5207 (Google Search) https://www.debian.org/security/2022/dsa-5207 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 https://marc.info/?l=netfilter-devel&m=165883202007292&w=2 https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.