Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel IPsec bug can crash system or run code
published 4 years ago
Summary
The Linux operating system's built‑in VPN feature (IPsec) can run out of memory when handling certain data, causing a crash. An attacker with local access could make the system stop working or potentially run their own programs. Apply the latest system updates to fix the issue.
What to do
- Update canonical linux-oem-5.14 to version 5.14.0-1031.34.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 |
< 5.14.0-1031.34 Fix: upgrade to 5.14.0-1031.34
|
Original advisory text
linux-oem-5.14 vulnerability
It was discovered that the IPsec implementation in the Linux kernel did not
properly allocate enough memory when performing ESP transformations,
leading to a heap-based buffer overflow. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code.
properly allocate enough memory when performing ESP transformations,
leading to a heap-based buffer overflow. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code.
References
- https://ubuntu.com/security/notices/USN-5353-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2022-27666 Third Party Advisory
Timeline
Published28 Mar 2022
Updated10 Sep 2026
First seen10 Sep 2026
Sources
USN-5353-1 · OSV
Track software like this
Free during beta