Ubuntu patches NVIDIA Tegra kernel denial-of-service flaws
Original title: USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities
Named issues include AX.25 use-after-free CVE-2022-1205 and i.MX clock null dereference CVE-2022-3114.
Ubuntu published USN-8963-1 for the Linux kernel NVIDIA Tegra packages. Race conditions in the AX.25 amateur radio implementation can cause use-after-free and a local system crash. A separate i.MX clock driver flaw can dereference a null pointer and crash the system. The notice also says other kernel issues could let an attacker compromise the system; the snippet does not list them all.
Unconfirmed: The notice is truncated and does not list every flaw or a fixed version.
- CVE-2022-1205 is a local use-after-free in the AX.25 implementation.
- CVE-2022-3114 is a null pointer dereference in the i.MX clock driver.
- Both named flaws can be used by a local attacker to crash the system.
- The notice says further kernel issues could compromise the system.
Impact: local denial of service or possible system compromise
| Product | Affected |
|---|---|
| Canonical Linux kernel (NVIDIA Tegra) | — |
- 1.Install the updated NVIDIA Tegra Linux kernel packages from Ubuntu.
- Vendors
- Canonical
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1205 | A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol | 4.7 | <1% | PoC | |
| CVE-2022-3114 | An issue was discovered in the Linux kernel through 5.16-rc6 | 5.5 | <1% |
From the original article
Duoming Zhou discovered race conditions in the AX. 25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash).
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.