Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel flaws allow local attackers to gain control or crash
published 4 years ago
Summary
Several parts of the Linux operating system, including process handling, NFC, security key handling, graphics memory, floppy and Wi‑Fi drivers, do not correctly check permissions or manage memory. This can let someone with local access steal data, gain admin rights, or cause the system to crash. Apply the latest security updates from your Linux distribution to fix these issues.
What to do
- Update canonical linux to version 4.4.0-229.263.
- Update canonical linux-aws to version 4.4.0-1145.160.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | linux |
< 4.4.0-229.263 Fix: upgrade to 4.4.0-229.263
|
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws |
< 4.4.0-1145.160 Fix: upgrade to 4.4.0-1145.160
|
Original advisory text
linux, linux-aws vulnerabilities
Eric Biederman discovered that the cgroup process migration implementation
in the Linux kernel did not perform permission checks correctly in some
situations. A local attacker could possibly use this to gain administrative
privileges. (CVE-2021-4197)
Lin Ma discovered that the NFC Controller Interface (NCI) implementation in
the Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-4202)
It was discovered that the PF_KEYv2 implementation in the Linux kernel did
not properly initialize kernel memory in some situations. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2022-1353)
It was discovered that the virtual graphics memory manager implementation
in the Linux kernel was subject to a race condition, potentially leading to
an information leak. (CVE-2022-1419)
Minh Yuan discovered that the floppy disk driver in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local attacker could possibly use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2022-1652)
It was discovered that the Atheros ath9k wireless device driver in the
Linux kernel did not properly handle some error conditions, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2022-1679)
It was discovered that the Marvell NFC device driver implementation in the
Linux kernel did not properly perform memory cleanup operations in some
situations, leading to a use-after-free vulnerability. A local attacker
could possibly use this to cause a denial of service (system crash) or
execute arbitrary code. (CVE-2022-1734)
赵子轩 discovered that the 802.2 LLC type 2 driver in the Linux kernel did not
properly perform reference counting in some error conditions. A local
attacker could use this to cause a denial of service. (CVE-2022-28356)
in the Linux kernel did not perform permission checks correctly in some
situations. A local attacker could possibly use this to gain administrative
privileges. (CVE-2021-4197)
Lin Ma discovered that the NFC Controller Interface (NCI) implementation in
the Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-4202)
It was discovered that the PF_KEYv2 implementation in the Linux kernel did
not properly initialize kernel memory in some situations. A local attacker
could use this to expose sensitive information (kernel memory).
(CVE-2022-1353)
It was discovered that the virtual graphics memory manager implementation
in the Linux kernel was subject to a race condition, potentially leading to
an information leak. (CVE-2022-1419)
Minh Yuan discovered that the floppy disk driver in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local attacker could possibly use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2022-1652)
It was discovered that the Atheros ath9k wireless device driver in the
Linux kernel did not properly handle some error conditions, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2022-1679)
It was discovered that the Marvell NFC device driver implementation in the
Linux kernel did not properly perform memory cleanup operations in some
situations, leading to a use-after-free vulnerability. A local attacker
could possibly use this to cause a denial of service (system crash) or
execute arbitrary code. (CVE-2022-1734)
赵子轩 discovered that the 802.2 LLC type 2 driver in the Linux kernel did not
properly perform reference counting in some error conditions. A local
attacker could use this to cause a denial of service. (CVE-2022-28356)
References
- https://ubuntu.com/security/notices/USN-5500-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2021-4197 Third Party Advisory
- https://ubuntu.com/security/CVE-2021-4202 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-1353 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-1419 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-1652 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-1679 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-1734 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-28356 Third Party Advisory
Timeline
Published1 Jul 2022
Updated10 Sep 2026
First seen10 Sep 2026
Sources
USN-5500-1 · OSV
Track software like this
Free during beta