Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux Azure and Raspi2 may crash or be hijacked
published 3 years ago
Summary
The Linux kernels used in Azure and Raspberry Pi 2 environments have several bugs that can let an attacker cause a system crash or potentially run their own code. These problems affect network handling, Bluetooth communication, and virtual machine networking. Apply the latest security updates from the vendor as soon as possible to protect your systems.
What to do
- Update canonical linux-azure-5.4 to version 5.4.0-1101.107~18.04.1.
- Update canonical linux-raspi2 to version 4.15.0-1126.134.
- Update canonical linux-azure to version 5.4.0-1101.107.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | linux-azure-5.4 |
< 5.4.0-1101.107~18.04.1 Fix: upgrade to 5.4.0-1101.107~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2 |
< 4.15.0-1126.134 Fix: upgrade to 4.15.0-1126.134
|
| Ubuntu:20.04:LTS | canonical | linux-azure |
< 5.4.0-1101.107 Fix: upgrade to 5.4.0-1101.107
|
Original advisory text
linux-azure, linux-azure-5.4, linux-raspi2 vulnerabilities
It was discovered that the NFSD implementation in the Linux kernel did not
properly handle some RPC messages, leading to a buffer overflow. A remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2022-43945)
Tamás Koczka discovered that the Bluetooth L2CAP handshake implementation
in the Linux kernel contained multiple use-after-free vulnerabilities. A
physically proximate attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-42896)
It was discovered that the Xen netback driver in the Linux kernel did not
properly handle packets structured in certain ways. An attacker in a guest
VM could possibly use this to cause a denial of service (host NIC
availability). (CVE-2022-3643)
It was discovered that an integer overflow vulnerability existed in the
Bluetooth subsystem in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2022-45934)
properly handle some RPC messages, leading to a buffer overflow. A remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2022-43945)
Tamás Koczka discovered that the Bluetooth L2CAP handshake implementation
in the Linux kernel contained multiple use-after-free vulnerabilities. A
physically proximate attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-42896)
It was discovered that the Xen netback driver in the Linux kernel did not
properly handle packets structured in certain ways. An attacker in a guest
VM could possibly use this to cause a denial of service (host NIC
availability). (CVE-2022-3643)
It was discovered that an integer overflow vulnerability existed in the
Bluetooth subsystem in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash).
(CVE-2022-45934)
References
- https://ubuntu.com/security/notices/USN-5830-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2022-3643 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-42896 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-43945 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-45934 Third Party Advisory
Timeline
Published27 Jan 2023
Updated22 Oct 2026
First seen22 Oct 2026
Sources
USN-5830-1 · OSV
Track software like this
Free during beta