USN-8668-2: Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu patches Linux kernel vulnerabilities for Raspberry Pi, including an NTFS flaw and an AMD processor speculative execution issue.
Ubuntu released security notice USN-8668-2 addressing vulnerabilities in the Linux kernel for Raspberry Pi, including CVE-2023-45896 in the NTFS implementation that allows out-of-bounds reads and potential kernel memory exposure. Another vulnerability, CVE-2025-54505, affects AMD processors by not properly clearing data during speculative execution, allowing local attackers to expose sensitive information. Patches are available for affected systems.
- Ubuntu Security Notice USN-8668-2 addresses vulnerabilities in the Linux kernel for Raspberry Pi.
- CVE-2023-45896 allows out-of-bounds reads via malicious NTFS images, potentially exposing kernel memory.
- CVE-2025-54505 allows local attackers to expose sensitive information on certain AMD processors.
- Vendors
- Ubuntu
- Products
- Linux kernelRaspberry Pi
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-45896 | ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is… | 7.1 | <1% | ||
| CVE-2025-54505 | A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially… | 2.0 | <1% |
From the original article
Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory).
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.