Ubuntu Azure CVM kernel update fixes AX.25 use-after-free
Original title: USN-8962-1: Linux kernel (Azure CVM) vulnerabilities
A local attacker can crash the system via CVE-2022-1205; other listed flaws could compromise the system.
Ubuntu published USN-8962-1 for the Linux kernel (Azure CVM). Duoming Zhou found race conditions in the AX.25 implementation that lead to use-after-free flaws; a local attacker could possibly crash the system (CVE-2022-1205). The notice also says other kernel issues could let an attacker compromise the system, including USB Gadget, several architectures, the block layer, Speakup, and ACPI.
Unconfirmed: Only CVE-2022-1205 is named; other flaws and exploitation status are unspecified.
- CVE-2022-1205 is limited in the text to local denial of service.
- Other subsystems include ARM64, x86, RISC-V, PowerPC, and S390.
- The snippet is cut off at serial drivers and names no further CVE ids.
- Fixed versions are not stated.
Impact: local crash or possible system compromise
| Product | Affected |
|---|---|
| Ubuntu Linux kernel (Azure CVM) | — |
- 1.Install the Linux kernel (Azure CVM) update from USN-8962-1.
- CVEs
- CVE-2022-1205
- Vendors
- Ubuntu
- Products
- Linux kernel (Azure CVM)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1205 | A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol | 4.7 | <1% | PoC |
From the original article
Duoming Zhou discovered race conditions in the AX. 25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash).
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.