Ubuntu patches Linux kernel flaws, including Xen frontend bugs
Original title: USN-9033-1: Linux kernel vulnerabilities
CVE-2022-23036 and CVE-2022-23037 could let a malicious Xen backend read guest memory or crash the guest.
Ubuntu published USN-9033-1 for Linux kernel vulnerabilities. Demi Marie Obenour and Simon Gaiser found that several Xen paravirtualization device frontends did not properly restrict backend access rights. A malicious backend could access a guest VM’s memory pages or cause a denial of service. Other fixes cover GPU, IIO ADC, network, PCI, VFIO, filesystem and related subsystems.
Unconfirmed: The truncated notice does not list every CVE or the fixed versions.
- The Xen issues are tracked as CVE-2022-23036 and CVE-2022-23037.
- Ubuntu says other kernel flaws could possibly be used to compromise the system.
- The snippet names GPU, bonding, PCI, VFIO and F2FS among corrected areas.
- Fixed package versions are not included in the feed text.
Impact: Guest memory access, guest denial of service, or system compromise
| Product | Affected |
|---|---|
| Canonical Linux kernel | — |
- 1.Apply the Linux kernel updates in USN-9033-1.
- Vendors
- Canonical
- Products
- Linux kernel
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2022-23036+1 related CVE | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs | 7.0 | <1% |
From the original article
Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in the guest. (CVE-2022-23036, CVE-2022-23037) Several security issues were discovered in the Linux kernel.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.