Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel on Oracle/GCP can expose data or crash
published 3 years ago
Summary
The Linux kernel used in the Oracle and Google Cloud Platform images has several bugs that let a user on the same machine read hidden memory or make the system crash. These problems affect core parts of the operating system, such as memory copying, virtual machine support, network protocols, and infrared drivers. Apply the latest kernel updates from your cloud provider to protect your servers.
What to do
- Update canonical linux-oracle to version 4.15.0-1119.130~16.04.1.
- Update canonical linux-gcp-4.15 to version 4.15.0-1150.166.
- Update canonical linux-oracle to version 4.15.0-1119.130.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | linux-oracle |
< 4.15.0-1119.130~16.04.1 Fix: upgrade to 4.15.0-1119.130~16.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-4.15 |
< 4.15.0-1150.166 Fix: upgrade to 4.15.0-1150.166
|
| Ubuntu:18.04:LTS | canonical | linux-oracle |
< 4.15.0-1119.130 Fix: upgrade to 4.15.0-1119.130
|
Original advisory text
linux-gcp-4.15, linux-oracle vulnerabilities
Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did
not properly implement speculative execution barriers in usercopy functions
in certain situations. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2023-0459)
Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel
did not properly initialize some data structures. A local attacker could
use this to expose sensitive information (kernel memory). (CVE-2023-1513)
It was discovered that a use-after-free vulnerability existed in the iSCSI
TCP implementation in the Linux kernel. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2023-2162)
It was discovered that the NET/ROM protocol implementation in the Linux
kernel contained a race condition in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2023-32269)
Duoming Zhou discovered that a race condition existed in the infrared
receiver/transceiver driver in the Linux kernel, leading to a use-after-
free vulnerability. A privileged attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2023-1118)
References
- https://ubuntu.com/security/notices/USN-6084-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-0459 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-1118 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-1513 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-2162 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-32269 Third Party Advisory
Timeline
Published17 May 2023
Updated22 Oct 2026
First seen22 Oct 2026
Sources
USN-6084-1 · OSV
Track software like this
Free during beta