Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6285-1 advisory.

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux     kernel did not properly perform permission checks in certain situations. A local attacker could possibly     use this to gain elevated privileges. (CVE-2023-2640)

    It was discovered that a race condition existed in the f2fs file system in the Linux kernel, leading to a     null pointer dereference vulnerability. An attacker could use this to construct a malicious f2fs image     that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-2898)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status     of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-31248)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

    It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel     did not properly perform reference counting in some situations, leading to a use-after-free vulnerability.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-3609)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

    It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

    It was discovered that the network packet classifier with netfilter/firewall marks implementation in the     Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-3776)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB     request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38430)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38432)

    It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability     when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to     cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).
    (CVE-2023-3863)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6261-1 advisory.

    It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory     in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6260-1 advisory.

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly check     buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker     could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

    Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux     kernel did not properly perform permission checks in certain situations. A local attacker could possibly     use this to gain elevated privileges. (CVE-2023-2640)

    It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory     in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status     of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-31248)

    It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a     race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    Querijn Voet discovered that a race condition existed in the io_uring subsystem in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-3389)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6251-1 advisory.

    It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory     in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6248-1 advisory.

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    It was discovered that a race condition existed in Adreno GPU DRM driver in the Linux kernel, leading to a     double-free vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-21106)

    Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux     kernel did not properly perform permission checks in certain situations. A local attacker could possibly     use this to gain elevated privileges. (CVE-2023-2640)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status     of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-31248)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    Querijn Voet discovered that a race condition existed in the io_uring subsystem in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-3389)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6250-1 advisory.

    Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux     kernel did not properly perform permission checks in certain situations. A local attacker could possibly     use this to gain elevated privileges. (CVE-2023-2640)

    It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory     in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status     of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-31248)

    Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did     not properly perform permission checks in certain situations. A local attacker could possibly use this to     gain elevated privileges. (CVE-2023-32629)

    Ruihan Li discovered that the memory management subsystem in the Linux kernel contained a race condition     when accessing VMAs in certain conditions, leading to a use-after-free vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2023-3269)

    Querijn Voet discovered that a race condition existed in the io_uring subsystem in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-3389)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error     conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

    Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain     pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
179706	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6285-1)	Nessus	Ubuntu Local Security Checks	critical
178974	Ubuntu 20.04 LTS : Linux kernel (IoT) vulnerabilities (USN-6261-1)	Nessus	Ubuntu Local Security Checks	critical
178946	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6260-1)	Nessus	Ubuntu Local Security Checks	critical
178914	Ubuntu 18.04 ESM / 20.04 LTS : Linux kernel vulnerabilities (USN-6251-1)	Nessus	Ubuntu Local Security Checks	critical
178798	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6248-1)	Nessus	Ubuntu Local Security Checks	critical
178797	Ubuntu 23.04 : Linux kernel vulnerabilities (USN-6250-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-32629

high

Tenable Plugins

critical

critical

critical

critical

critical

critical