Ubuntu patches AWS Linux kernel flaws, including Xen frontend bug
Original title: USN-9034-1: Linux kernel (AWS) vulnerabilities
A malicious Xen backend could read guest memory pages or crash the guest; other kernel subsystems are also fixed.
Ubuntu published USN-9034-1 for the Linux kernel (AWS). Demi Marie Obenour and Simon Gaiser found that several Xen paravirtualization device frontends did not properly restrict backend access rights. A malicious Xen backend could access a guest VM’s memory pages or cause a denial of service (CVE-2022-23037). The update also corrects issues in GPU, IIO ADC, network, PCI, VFIO, filesystem and other subsystems.
Unconfirmed: The feed snippet is truncated and does not list fixed versions or every CVE.
- CVE-2022-23037 covers Xen device frontends that fail to restrict backend rights.
- Ubuntu says an attacker could possibly use other kernel issues to compromise the system.
- Named areas include GPU drivers, Ethernet bonding, network drivers, PCI, VFIO and F2FS.
- The notice snippet does not give package versions or the full CVE list.
Impact: Guest memory access, guest denial of service, or system compromise
| Product | Affected |
|---|---|
| Canonical Linux kernel (AWS) | — |
- 1.Apply the Linux kernel (AWS) updates in USN-9034-1.
- CVEs
- CVE-2022-23037
- Vendors
- Canonical
- Products
- Linux kernel
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-23037 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs | 7.0 | <1% |
From the original article
Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in the guest. (CVE-2022-23037) Several security issues were discovered in the Linux kernel.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.