Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6206.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6206-1)
Summary:	The remote host is missing an update for the 'linux-oem-5.17' package(s) announced via the USN-6206-1 advisory.
Description:	Summary: The remote host is missing an update for the 'linux-oem-5.17' package(s) announced via the USN-6206-1 advisory. Vulnerability Insight: Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35788, LP: #2023577) It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-4842) Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu memory management structure. A local attacker could use this to expose sensitive information (kernel memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597) It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124) It was discovered that for some Intel processors the INVLPG instruction implementation did not properly flush global TLB entries when PCIDs are enabled. An attacker could use this to expose sensitive information (kernel memory) or possibly cause undesired behaviors. (LP: #2023220) Affected Software/OS: 'linux-oem-5.17' package(s) on Ubuntu 22.04. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-4842 https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af@paragon-software.com/T/#t Common Vulnerability Exposure (CVE) ID: CVE-2023-0597 https://git.kernel.org/linus/97e3d26b5e5f371b3ee223d94dd123e6c442ba80 http://www.openwall.com/lists/oss-security/2023/07/28/1 Common Vulnerability Exposure (CVE) ID: CVE-2023-2124 Debian Security Information: DSA-5448 (Google Search) https://www.debian.org/security/2023/dsa-5448 Debian Security Information: DSA-5480 (Google Search) https://www.debian.org/security/2023/dsa-5480 https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/xfs/xfs_buf_item_recover.c?h=v6.4-rc1&id=22ed903eee23a5b174e240f1cdfa9acf393a5210 https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html Common Vulnerability Exposure (CVE) ID: CVE-2023-35788 http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.7 https://git.kernel.org/linus/4d56304e5827c8cc8cc18c75343d283af7c4825c https://www.openwall.com/lists/oss-security/2023/06/07/1 https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html http://www.openwall.com/lists/oss-security/2023/06/17/1
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.