Ubuntu fixes Linux kernel flaws including AX.25 use-after-free
Original title: USN-8961-1: Linux kernel vulnerabilities
CVE-2022-1205 is a local race that can crash the system; the notice also covers many other kernel subsystems.
Ubuntu security notice USN-8961-1 says Duoming Zhou found race conditions in the Linux kernel’s AX.25 amateur-radio implementation that lead to use-after-free flaws. A local attacker could use CVE-2022-1205 to cause a denial of service by crashing the system. The same update corrects additional kernel issues across USB gadget drivers, networking, several CPU architectures, the block layer, Speakup and ACPI, which an attacker could possibly use to compromise the system.
Unconfirmed: The excerpt names only CVE-2022-1205 and does not list fixed package versions or exploitation status.
- CVE-2022-1205 is a local use-after-free from AX.25 race conditions.
- The stated impact of that bug is a system crash.
- Other fixes span USB gadget, networking, ARM, PowerPC, RISC-V, s390, x86 and ACPI.
Impact: Local denial of service; other flaws might compromise the system
| Product | Affected |
|---|---|
| Linux kernel | — |
- 1.Install the Ubuntu kernel update from USN-8961-1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1205 | A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol | 4.7 | <1% | PoC |
From the original article
Duoming Zhou discovered race conditions in the AX. 25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash).
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.