Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6339.2
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6339-2)
Summary:	The remote host is missing an update for the 'linux-gcp-5.15, linux-gkeop-5.15' package(s) announced via the USN-6339-2 advisory.
Description:	Summary: The remote host is missing an update for the 'linux-gcp-5.15, linux-gkeop-5.15' package(s) announced via the USN-6339-2 advisory. Vulnerability Insight: It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-48425) Zi Fan Tan discovered that the binder IPC implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21255) It was discovered that a race condition existed in the f2fs file system in the Linux kernel, leading to a null pointer dereference vulnerability. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-2898) It was discovered that the DVB Core driver in the Linux kernel did not properly handle locking events in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2023-31084) Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212) It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes in certain operations, leading to an out-of- bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38426, CVE-2023-38428) It was discovered that the KSMBD implementation in the Linux kernel did not properly calculate the size of certain buffers. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-38429) Affected Software/OS: 'linux-gcp-5.15, linux-gkeop-5.15' package(s) on Ubuntu 20.04. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-48425 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=467333af2f7b95eeaa61a5b5369a80063cd971fd https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/fs/ntfs3?id=467333af2f7b95eeaa61a5b5369a80063cd971fd Common Vulnerability Exposure (CVE) ID: CVE-2023-21255 Debian Security Information: DSA-5480 (Google Search) https://www.debian.org/security/2023/dsa-5480 https://android.googlesource.com/kernel/common/+/1ca1130ec62d https://source.android.com/security/bulletin/2023-07-01 https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html Common Vulnerability Exposure (CVE) ID: CVE-2023-2898 Debian Security Information: DSA-5492 (Google Search) https://www.debian.org/security/2023/dsa-5492 https://lore.kernel.org/linux-f2fs-devel/20230522124203.3838360-1-chao@kernel.org/ Common Vulnerability Exposure (CVE) ID: CVE-2023-31084 Debian Security Information: DSA-5448 (Google Search) https://www.debian.org/security/2023/dsa-5448 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HIEOLEOURP4BJZMIL7UGGPYRRB44UDN/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOATNX5UFL7V7W2QDIQKOHFFHYKWFP4W/ https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b8c75e4a1b325ea0a9433fa8834be97b5836b946 https://lore.kernel.org/all/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/ https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html Common Vulnerability Exposure (CVE) ID: CVE-2023-3212 https://bugzilla.redhat.com/show_bug.cgi?id=2214348 https://github.com/torvalds/linux/commit/504a10d9e46bc37b23d0a1ae2f28973c8516e636 https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html Common Vulnerability Exposure (CVE) ID: CVE-2023-38426 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=02f76c401d17e409ed45bf7887148fcc22c93c85 Common Vulnerability Exposure (CVE) ID: CVE-2023-38428 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=f0a96d1aafd8964e1f9955c830a3e5cb3c60a90f Common Vulnerability Exposure (CVE) ID: CVE-2023-38429 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=443d61d1fa9faa60ef925513d83742902390100f
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.