Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux OEM 6.1 kernel may crash or be hijacked
published 3 years ago
Summary
The Linux kernel version 6.1 shipped by Canonical (linux‑oem‑6.1) has several bugs that could let a local user cause the system to freeze or potentially run their own code. These problems affect network handling, sound drivers and a graphics driver. Apply the latest security updates from Canonical as soon as possible to protect your servers and workstations.
What to do
- Update canonical linux-oem-6.1 to version 6.1.0-1006.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 |
< 6.1.0-1006.6 Fix: upgrade to 6.1.0-1006.6
|
Original advisory text
linux-oem-6.1 vulnerabilities
Davide Ornaghi discovered that the netfilter subsystem in the Linux kernel
did not properly handle VLAN headers in some situations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-0179)
Hu Jiahui discovered that multiple race conditions existed in the Advanced
Linux Sound Architecture (ALSA) framework, leading to use-after-free
vulnerabilities. A local attacker could use these to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2022-1048)
It was discovered that a use-after-free vulnerability existed in the SGI
GRU driver in the Linux kernel. A local attacker could possibly use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3424)
did not properly handle VLAN headers in some situations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-0179)
Hu Jiahui discovered that multiple race conditions existed in the Advanced
Linux Sound Architecture (ALSA) framework, leading to use-after-free
vulnerabilities. A local attacker could use these to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2022-1048)
It was discovered that a use-after-free vulnerability existed in the SGI
GRU driver in the Linux kernel. A local attacker could possibly use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3424)
References
- https://ubuntu.com/security/notices/USN-5856-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2022-1048 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-3424 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-0179 Third Party Advisory
Timeline
Published9 Feb 2023
Updated22 Oct 2026
First seen22 Oct 2026
Sources
USN-5856-1 · OSV
Track software like this
Free during beta