CVE-2023-52881
Published: 29 May 2024
In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through. This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent. This greatly improves TCP security at a little cost. I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC. tp->bytes_acked was added in linux-4.2 Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1024) = 0 // ---------------- Handshake ------------------- // // when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server. +0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14> +0 > S. 0:0(0) ack 1 <...> +0 < . 1:1(0) ack 1 win 65535 +0 accept(3, ..., ...) = 4 // For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around. // Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases. // 1 - 1073725300 + 2^32 = 3221241997 // Oops, old kernels happily accept this packet. +0 < . 1:1001(1000) ack 3221241997 win 65535 // After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped. +0 > . 1:1(0) ack 1001
Priority
Status
Package | Release | Status |
---|---|---|
linux Launchpad, Ubuntu, Debian |
bionic |
Ignored
(ESM criteria, was needed)
|
focal |
Pending
(5.4.0-173.191)
|
|
jammy |
Pending
(5.15.0-100.110)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-25.25])
|
|
noble |
Not vulnerable
(6.8.0-11.11)
|
|
trusty |
Ignored
(ESM criteria, was needed)
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
Patches: Introduced by 354e4aa391ed50a4d827ff6fc11e0667d0859b25 |
||
linux-allwinner-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(end of kernel support)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-aws Launchpad, Ubuntu, Debian |
bionic |
Ignored
(ESM criteria, was needed)
|
focal |
Pending
(5.4.0-1120.130)
|
|
jammy |
Pending
(5.15.0-1056.61)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1015.15])
|
|
noble |
Not vulnerable
(6.8.0-1001.1)
|
|
trusty |
Ignored
(ESM criteria, was needed)
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-aws-5.3)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-5.3)
|
|
linux-aws-5.11 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-aws-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-5.13)
|
|
linux-aws-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-aws-5.15)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-5.15)
|
|
linux-aws-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1056.61~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-aws-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-aws-6.2)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-6.2)
|
|
linux-aws-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-aws-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-5.4)
|
|
linux-aws-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-1120.130~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-aws-5.8 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-aws-5.11)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-5.11)
|
|
linux-aws-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-aws-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-aws-6.5)
|
|
linux-aws-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1015.15~22.04.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-aws-fips Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-azure Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-azure-5.3)
|
focal |
Pending
(5.4.0-1126.133)
|
|
jammy |
Pending
(5.15.0-1058.66)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1016.16])
|
|
noble |
Not vulnerable
(6.8.0-1001.1)
|
|
trusty |
Ignored
(ESM criteria, was needed)
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-azure-4.15 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(ESM criteria, was needed)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-azure-5.11 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-azure-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-5.13)
|
|
linux-azure-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-azure-5.15)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-5.15)
|
|
linux-azure-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1058.66~20.04.2)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-azure-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-azure-6.2)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-6.2)
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-azure-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-5.4)
|
|
linux-azure-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-1126.133~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-azure-5.8 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-azure-5.11)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-5.11)
|
|
linux-azure-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-azure-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-6.5)
|
|
linux-azure-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1016.16~22.04.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-azure-5.3)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-5.3)
|
|
linux-azure-fde Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-azure-fde-5.15)
|
jammy |
Released
(5.15.0-1058.66.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-azure-fde-5.15 Launchpad, Ubuntu, Debian |
focal |
Released
(5.15.0-1058.66~20.04.2.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-azure-fde-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-azure-fde-6.2)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-azure-fde-6.2)
|
|
linux-azure-fde-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(replaced by linux-azure-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(replaced by linux-azure-6.5)
|
|
linux-azure-fips Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-bluefield Launchpad, Ubuntu, Debian |
focal |
Pending
(5.4.0-1080.87)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-fips Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gcp Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-gcp-5.3)
|
focal |
Pending
(5.4.0-1124.133)
|
|
jammy |
Pending
(5.15.0-1053.61)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1015.15])
|
|
noble |
Not vulnerable
(6.8.0-1002.2)
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-gcp-4.15 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(ESM criteria, was needed)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gcp-5.11 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-gcp-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gcp-5.13)
|
|
linux-gcp-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-gcp-5.15)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gcp-5.15)
|
|
linux-gcp-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1053.61~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gcp-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-gcp-6.2)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gcp-6.2)
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-gcp-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gcp-5.4)
|
|
linux-gcp-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-1124.133~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gcp-5.8 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-gcp-5.11)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gcp-5.11)
|
|
linux-gcp-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-gcp-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gcp-6.5)
|
|
linux-gcp-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1015.15~22.04.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gcp-fips Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gke Launchpad, Ubuntu, Debian |
focal |
Ignored
(end of kernel support)
|
jammy |
Pending
(5.15.0-1052.57)
|
|
mantic |
Does not exist
|
|
noble |
Not vulnerable
(6.8.0-1003.5)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-gke-5.0)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-gke-5.0)
|
|
linux-gke-5.15 Launchpad, Ubuntu, Debian |
focal |
Ignored
(end of kernel support)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-gke-5.4 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of kernel support)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-gkeop Launchpad, Ubuntu, Debian |
focal |
Pending
(5.4.0-1087.91)
|
jammy |
Pending
(5.15.0-1038.44)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gkeop-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1038.44~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-gkeop-5.4 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of kernel support)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-hwe Launchpad, Ubuntu, Debian |
bionic |
Ignored
(replaced by linux-hwe-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-hwe-5.11 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-hwe-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-hwe-5.13)
|
|
linux-hwe-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-hwe-5.15)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-hwe-5.15)
|
|
linux-hwe-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-100.110~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-hwe-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-hwe-6.2)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-hwe-6.2)
|
|
linux-hwe-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-173.191~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-hwe-5.8 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-hwe-5.11)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-hwe-5.11)
|
|
linux-hwe-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-hwe-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-hwe-6.5)
|
|
linux-hwe-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-hwe-6.8, was pending [6.5.0-25.25~22.04.1])
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-hwe-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
xenial |
Ignored
(superseded by linux-hwe)
|
|
linux-ibm Launchpad, Ubuntu, Debian |
focal |
Pending
(5.4.0-1067.72)
|
jammy |
Pending
(5.15.0-1048.51)
|
|
mantic |
Ignored
(end of kernel support)
|
|
noble |
Not vulnerable
(6.8.0-1001.1)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-ibm-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1048.51~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-ibm-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-1067.72~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-intel Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Not vulnerable
(6.8.0-1001.6)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Does not exist
|
|
linux-intel-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(end of kernel support)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-intel-iotg Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(5.15.0-1050.56)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-intel-iotg-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1050.56~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-iot Launchpad, Ubuntu, Debian |
focal |
Pending
(5.4.0-1032.33)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-kvm Launchpad, Ubuntu, Debian |
bionic |
Ignored
(ESM criteria, was needed)
|
focal |
Pending
(5.4.0-1108.115)
|
|
jammy |
Pending
(5.15.0-1052.57)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-laptop Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1011.14])
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-lowlatency Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(5.15.0-100.110)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-25.25.1])
|
|
noble |
Not vulnerable
(6.8.0-7.7.1)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-lowlatency-hwe-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-100.110~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-lowlatency-hwe-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-lowlatency-hwe-6.2)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-lowlatency-hwe-6.2)
|
|
linux-lowlatency-hwe-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-lowlatency-hwe-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-lowlatency-hwe-6.5)
|
|
linux-lowlatency-hwe-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-lowlatency-hwe-6.8, was pending [6.5.0-25.25.1~22.04.1])
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Ignored
(ESM criteria, was needed)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-nvidia Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(5.15.0-1046.46)
|
|
mantic |
Does not exist
|
|
noble |
Not vulnerable
(6.8.0-1007.7)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-nvidia-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-nvidia-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-nvidia-6.5)
|
|
linux-nvidia-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1014.14)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Ignored
(replaced by linux-hwe-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-oem-5.10 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-oem-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oem-5.13)
|
|
linux-oem-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-oem-5.14)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oem-5.14)
|
|
linux-oem-5.14 Launchpad, Ubuntu, Debian |
focal |
Ignored
(replaced by linux-hwe-5.15)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(replaced by linux-hwe-5.15)
|
|
linux-oem-5.17 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-oem-6.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oem-6.1)
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-oem-5.10)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oem-5.10)
|
|
linux-oem-6.0 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-oem-6.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oem-6.1)
|
|
linux-oem-6.1 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-oem-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oem-6.5)
|
|
linux-oem-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1016.17)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-oem-6.8 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Not vulnerable
(6.8.0-1003.3)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Does not exist
|
|
linux-oracle Launchpad, Ubuntu, Debian |
bionic |
Ignored
(ESM criteria, was needed)
|
focal |
Pending
(5.4.0-1119.128)
|
|
jammy |
Pending
(5.15.0-1053.59)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1018.18])
|
|
noble |
Not vulnerable
(6.8.0-1001.1)
|
|
upstream |
Released
(6.7~rc5)
|
|
xenial |
Ignored
(ESM criteria, was needed)
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-oracle-5.3)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oracle-5.3)
|
|
linux-oracle-5.11 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-oracle-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oracle-5.13)
|
|
linux-oracle-5.13 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-oracle-5.15)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oracle-5.15)
|
|
linux-oracle-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1053.59~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-oracle-5.4)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oracle-5.4)
|
|
linux-oracle-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-1119.128~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-oracle-5.8 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-oracle-5.11)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-oracle-5.11)
|
|
linux-oracle-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1018.18~22.04.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-raspi Launchpad, Ubuntu, Debian |
focal |
Pending
(5.4.0-1104.116)
|
jammy |
Pending
(5.15.0-1048.51)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1012.15])
|
|
noble |
Not vulnerable
(6.7.0-1001.1)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-raspi-5.4 Launchpad, Ubuntu, Debian |
bionic |
Pending
(5.4.0-1104.116~18.04.1)
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
focal |
Ignored
(replaced by linux-raspi)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(replaced by linux-raspi)
|
|
linux-riscv Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-riscv-5.8)
|
jammy |
Ignored
(end of kernel support)
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-25.25.1])
|
|
noble |
Not vulnerable
(6.8.0-20.20.1)
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-riscv-5.11 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-riscv-5.13)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-riscv-5.13)
|
|
linux-riscv-5.15 Launchpad, Ubuntu, Debian |
focal |
Pending
(5.15.0-1051.55~20.04.1)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-riscv-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(end of kernel support)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-riscv-5.8 Launchpad, Ubuntu, Debian |
focal |
Ignored
(superseded by linux-riscv-5.11)
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-riscv-5.11)
|
|
linux-riscv-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(end of life, was pending [6.5.0-25.25.1~22.04.1])
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-starfive Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Does not exist
|
|
mantic |
Ignored
(end of life, was pending [6.5.0-1009.10])
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-starfive-5.19 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(end of kernel support)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(end of life)
|
|
linux-starfive-6.2 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Ignored
(superseded by linux-starfive-6.5)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Ignored
(superseded by linux-starfive-6.5)
|
|
linux-starfive-6.5 Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Pending
(6.5.0-1009.10~22.04.1)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
|
linux-xilinx-zynqmp Launchpad, Ubuntu, Debian |
focal |
Pending
(5.4.0-1039.43)
|
jammy |
Pending
(5.15.0-1030.34)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Released
(6.7~rc5)
|
References
- https://www.cve.org/CVERecord?id=CVE-2023-52881
- https://git.kernel.org/linus/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 (6.7-rc5)
- https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57
- https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a
- https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0
- https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a
- https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc
- https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440
- https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757
- https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27
- NVD
- Launchpad
- Debian