Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernels on GCP/Oracle may crash or run malicious code
published 4 years ago
Summary
The core of Linux used in certain Google Cloud and Oracle virtual machines can mishandle internal tracking, letting a local attacker cause the system to stop working or run their own code. Another issue lets a local attacker ignore security sandbox limits. Apply the latest kernel updates from your Linux distribution to fix these problems and restart the machines.
What to do
- Update canonical linux-gcp-5.13 to version 5.13.0-1027.32~20.04.1.
- Update canonical linux-oracle-5.13 to version 5.13.0-1030.35~20.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 |
< 5.13.0-1027.32~20.04.1 Fix: upgrade to 5.13.0-1027.32~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 |
< 5.13.0-1030.35~20.04.1 Fix: upgrade to 5.13.0-1030.35~20.04.1
|
Original advisory text
linux-gcp-5.13, linux-oracle, linux-oracle-5.13 vulnerabilities
Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of
the Linux kernel did not properly perform reference counting in some
situations, leading to a use-after-free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2022-29581)
Jann Horn discovered that the Linux kernel did not properly enforce seccomp
restrictions in some situations. A local attacker could use this to bypass
intended seccomp sandbox restrictions. (CVE-2022-30594)
the Linux kernel did not properly perform reference counting in some
situations, leading to a use-after-free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2022-29581)
Jann Horn discovered that the Linux kernel did not properly enforce seccomp
restrictions in some situations. A local attacker could use this to bypass
intended seccomp sandbox restrictions. (CVE-2022-30594)
References
- https://ubuntu.com/security/notices/USN-5443-2 Vendor Advisory
- https://ubuntu.com/security/CVE-2022-29581 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-30594 Third Party Advisory
Timeline
Published1 Jun 2022
Updated10 Sep 2026
First seen10 Sep 2026
Sources
USN-5443-2 · OSV
Track software like this
Free during beta