Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel packages can cause system crash
published 2 years ago
Summary
Several Linux kernel packages from Canonical (including standard, HWE, IBM, Oracle and Bluefield builds) contain driver bugs that may let a user on the same machine make the system stop working or crash. The problems affect USB, display, network filtering and storage drivers and could also allow limited code execution. Apply the latest updates from your package manager as soon as they are available to fix the issues.
What to do
- Update canonical linux-hwe-5.4 to version 5.4.0-174.193~18.04.1.
- Update canonical linux-ibm-5.4 to version 5.4.0-1068.73~18.04.1.
- Update canonical linux-oracle-5.4 to version 5.4.0-1120.129~18.04.1.
- Update canonical linux to version 5.4.0-174.193.
- Update canonical linux-bluefield to version 5.4.0-1081.88.
- Update canonical linux-gcp to version 5.4.0-1125.134.
- Update canonical linux-gkeop to version 5.4.0-1088.92.
- Update canonical linux-ibm to version 5.4.0-1068.73.
- Update canonical linux-iot to version 5.4.0-1033.34.
- Update canonical linux-kvm to version 5.4.0-1109.116.
- Update canonical linux-oracle to version 5.4.0-1120.129.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | linux-hwe-5.4 |
< 5.4.0-174.193~18.04.1 Fix: upgrade to 5.4.0-174.193~18.04.1
|
| Ubuntu:Pro:18.04:LTS | canonical | linux-ibm-5.4 |
< 5.4.0-1068.73~18.04.1 Fix: upgrade to 5.4.0-1068.73~18.04.1
|
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle-5.4 |
< 5.4.0-1120.129~18.04.1 Fix: upgrade to 5.4.0-1120.129~18.04.1
|
| Ubuntu:20.04:LTS | canonical | linux |
< 5.4.0-174.193 Fix: upgrade to 5.4.0-174.193
|
| Ubuntu:20.04:LTS | canonical | linux-bluefield |
< 5.4.0-1081.88 Fix: upgrade to 5.4.0-1081.88
|
| Ubuntu:20.04:LTS | canonical | linux-gcp |
< 5.4.0-1125.134 Fix: upgrade to 5.4.0-1125.134
|
| Ubuntu:20.04:LTS | canonical | linux-gkeop |
< 5.4.0-1088.92 Fix: upgrade to 5.4.0-1088.92
|
| Ubuntu:20.04:LTS | canonical | linux-ibm |
< 5.4.0-1068.73 Fix: upgrade to 5.4.0-1068.73
|
| Ubuntu:20.04:LTS | canonical | linux-iot |
< 5.4.0-1033.34 Fix: upgrade to 5.4.0-1033.34
|
| Ubuntu:20.04:LTS | canonical | linux-kvm |
< 5.4.0-1109.116 Fix: upgrade to 5.4.0-1109.116
|
| Ubuntu:20.04:LTS | canonical | linux-oracle |
< 5.4.0-1120.129 Fix: upgrade to 5.4.0-1120.129
|
Original advisory text
linux, linux-bluefield, linux-gcp, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities
It was discovered that the NVIDIA Tegra XUSB pad controller driver in the
Linux kernel did not properly handle return values in certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-23000)
It was discovered that the ARM Mali Display Processor driver implementation
in the Linux kernel did not properly handle certain error conditions. A
local attacker could possibly use this to cause a denial of service (system
crash). (CVE-2023-23004)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
Linux kernel did not properly handle return values in certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-23000)
It was discovered that the ARM Mali Display Processor driver implementation
in the Linux kernel did not properly handle certain error conditions. A
local attacker could possibly use this to cause a denial of service (system
crash). (CVE-2023-23004)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
References
- https://ubuntu.com/security/notices/USN-6702-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-23000 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-23004 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-1086 Third Party Advisory
- https://ubuntu.com/security/CVE-2024-24855 Third Party Advisory
Timeline
Published19 Mar 2024
Updated22 Oct 2026
First seen22 Oct 2026
Sources
USN-6702-1 · OSV
Track software like this
Free during beta