Ubuntu patches Raspberry Pi kernel flaws, including AX.25
Original title: USN-9029-1: Linux kernel (Raspberry Pi) vulnerabilities
Local attackers could crash the system via AX.25 use-after-free and an i.MX clock null-pointer flaw.
USN-9029-1 covers Linux kernel vulnerabilities in Ubuntu's Raspberry Pi kernel. Duoming Zhou found race conditions in the AX.25 amateur radio implementation that lead to use-after-free and possible local denial of service (CVE-2022-1205). A separate i.MX clock-driver flaw can cause a null pointer dereference and a local system crash (CVE-2022-3114). The notice says further kernel issues could possibly be used to compromise the system.
Unconfirmed: The snippet is cut off, so additional flaws, package versions and fixes are not stated.
- The notice applies to the Ubuntu Raspberry Pi Linux kernel.
- CVE-2022-1205 is a local use-after-free in AX.25.
- CVE-2022-3114 is a local null pointer dereference in the i.MX clock driver.
- Both described impacts are denial of service through a system crash.
Impact: Local denial of service via kernel crashes
| Product | Affected |
|---|---|
| Canonical Linux kernel (Raspberry Pi) | — |
- 1.Install the Raspberry Pi kernel update in USN-9029-1.
- Vendors
- Canonical
- Products
- Linux kernel (Raspberry Pi)
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1205 | A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol | 4.7 | <1% | PoC | |
| CVE-2022-3114 | An issue was discovered in the Linux kernel through 5.16-rc6 | 5.5 | <1% |
From the original article
Duoming Zhou discovered race conditions in the AX. 25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash).
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.