USN-7003-1: Linux kernel vulnerabilities

Releases

• Ubuntu 20.04 LTS

Packages

• linux - Linux kernel
• linux-aws - Linux kernel for Amazon Web Services (AWS) systems
• linux-azure - Linux kernel for Microsoft Azure Cloud systems
• linux-bluefield - Linux kernel for NVIDIA BlueField platforms
• linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
• linux-gkeop - Linux kernel for Google Container Engine (GKE) systems
• linux-ibm - Linux kernel for IBM cloud systems
• linux-kvm - Linux kernel for cloud environments
• linux-oracle - Linux kernel for Oracle Cloud systems

Details

It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers;
  (CVE-2024-40905, CVE-2024-41095, CVE-2024-41035, CVE-2024-36974,
  CVE-2024-40959, CVE-2024-40978, CVE-2024-42236, CVE-2024-40963,
  CVE-2024-40916, CVE-2024-41006, CVE-2024-39495, CVE-2023-52803,
  CVE-2024-42070, CVE-2024-41041, CVE-2024-42157, CVE-2024-36894,
  CVE-2024-42153, CVE-2024-42127, CVE-2024-42224, CVE-2024-40932,
  CVE-2024-42105, CVE-2024-40968, CVE-2024-41044, CVE-2024-41046,
  CVE-2023-52887, CVE-2024-42094, CVE-2024-40960, CVE-2024-41007,
  CVE-2024-40961, CVE-2024-39487, CVE-2024-39502, CVE-2024-42086,
  CVE-2024-36978, CVE-2024-39503, CVE-2024-41049, CVE-2024-42090,
  CVE-2024-42232, CVE-2024-39499, CVE-2024-40902, CVE-2024-37078,
  CVE-2024-39501, CVE-2024-42119, CVE-2024-40901, CVE-2024-42101,
  CVE-2024-42104, CVE-2024-42145, CVE-2024-41097, CVE-2024-40942,
  CVE-2024-41034, CVE-2024-40904, CVE-2024-41089, CVE-2024-42084,
  CVE-2024-42093, CVE-2024-40945, CVE-2024-40958, CVE-2024-42124,
  CVE-2024-40987, CVE-2024-40912, CVE-2024-39506, CVE-2024-40941,
  CVE-2024-39509, CVE-2024-40974, CVE-2024-39505, CVE-2024-42115,
  CVE-2024-40988, CVE-2024-40995, CVE-2024-42097, CVE-2024-41087,
  CVE-2024-42106, CVE-2024-40984, CVE-2024-40981, CVE-2024-42102,
  CVE-2024-42148, CVE-2024-42154, CVE-2024-42096, CVE-2024-40934,
  CVE-2024-40980, CVE-2024-42076, CVE-2024-40943, CVE-2024-42092,
  CVE-2024-42089, CVE-2024-42223, CVE-2024-38619, CVE-2024-42087,
  CVE-2024-39469)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• linux-image-5.4.0-1079-ibm - 5.4.0-1079.84
• linux-image-5.4.0-1092-bluefield - 5.4.0-1092.99
• linux-image-5.4.0-1099-gkeop - 5.4.0-1099.103
• linux-image-5.4.0-1120-kvm - 5.4.0-1120.128
• linux-image-5.4.0-1131-oracle - 5.4.0-1131.140
• linux-image-5.4.0-1132-aws - 5.4.0-1132.142
• linux-image-5.4.0-1136-gcp - 5.4.0-1136.145
• linux-image-5.4.0-1137-azure - 5.4.0-1137.144
• linux-image-5.4.0-195-generic - 5.4.0-195.215
• linux-image-5.4.0-195-generic-lpae - 5.4.0-195.215
• linux-image-5.4.0-195-lowlatency - 5.4.0-195.215
• linux-image-aws-lts-20.04 - 5.4.0.1132.129
• linux-image-azure-lts-20.04 - 5.4.0.1137.131
• linux-image-bluefield - 5.4.0.1092.88
• linux-image-gcp-lts-20.04 - 5.4.0.1136.138
• linux-image-generic - 5.4.0.195.193
• linux-image-generic-lpae - 5.4.0.195.193
• linux-image-gkeop - 5.4.0.1099.97
• linux-image-gkeop-5.4 - 5.4.0.1099.97
• linux-image-ibm-lts-20.04 - 5.4.0.1079.108
• linux-image-kvm - 5.4.0.1120.116
• linux-image-lowlatency - 5.4.0.195.193
• linux-image-oem - 5.4.0.195.193
• linux-image-oem-osp1 - 5.4.0.195.193
• linux-image-oracle-lts-20.04 - 5.4.0.1131.124
• linux-image-virtual - 5.4.0.195.193

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

• CVE-2024-39501
• CVE-2024-40945
• CVE-2024-42119
• CVE-2024-40981
• CVE-2024-41095
• CVE-2024-42157
• CVE-2024-40995
• CVE-2024-41035
• CVE-2024-41041
• CVE-2024-42090
• CVE-2024-40988
• CVE-2024-40987
• CVE-2024-42087
• CVE-2024-40904
• CVE-2024-42224
• CVE-2024-42232
• CVE-2024-42089
• CVE-2024-42148
• CVE-2024-41087
• CVE-2024-41049
• CVE-2024-41097
• CVE-2024-42105
• CVE-2024-37078
• CVE-2024-42076
• CVE-2024-40942
• CVE-2024-40934
• CVE-2024-40959
• CVE-2024-42127
• CVE-2024-39469
• CVE-2024-42101
• CVE-2024-40974
• CVE-2024-42153
• CVE-2024-39503
• CVE-2024-40932
• CVE-2024-42102
• CVE-2024-39487
• CVE-2024-40958
• CVE-2024-42097
• CVE-2024-39502
• CVE-2024-39499
• CVE-2024-40916
• CVE-2023-52887
• CVE-2024-40978
• CVE-2024-42236
• CVE-2024-38619
• CVE-2024-40943
• CVE-2024-42070
• CVE-2024-40941
• CVE-2024-40902
• CVE-2024-42096
• CVE-2024-40984
• CVE-2024-42084
• CVE-2024-40963
• CVE-2024-39495
• CVE-2024-39509
• CVE-2024-39505
• CVE-2024-42145
• CVE-2024-42106
• CVE-2024-42093
• CVE-2024-42223
• CVE-2024-40901
• CVE-2024-40980
• CVE-2024-42154
• CVE-2024-36978
• CVE-2024-41089
• CVE-2024-40960
• CVE-2024-42094
• CVE-2024-39506
• CVE-2024-41007
• CVE-2023-52803
• CVE-2024-36974
• CVE-2024-40912
• CVE-2024-42092
• CVE-2024-42115
• CVE-2024-42124
• CVE-2024-41006
• CVE-2024-42086
• CVE-2024-40968
• CVE-2024-42104
• CVE-2024-41034
• CVE-2024-41044
• CVE-2024-40905
• CVE-2024-40961
• CVE-2024-36894
• CVE-2024-41046

Related notices

• USN-6999-1
• USN-7003-2
• USN-7004-1
• USN-7005-1
• USN-7006-1
• USN-7003-3
• USN-7007-1
• USN-7008-1
• USN-7005-2
• USN-7009-1
• USN-7019-1
• USN-7007-2
• USN-6999-2
• USN-7029-1
• USN-7007-3
• USN-7009-2
• USN-7003-4
• USN-7003-5
• USN-7089-1
• USN-7090-1
• USN-7089-2
• USN-7089-3
• USN-7095-1
• USN-7089-4
• USN-7089-5
• USN-7089-6
• USN-7089-7
• USN-7121-1
• USN-7121-2
• USN-7121-3
• USN-7148-1
• USN-7069-1
• USN-7069-2
• USN-7020-1
• USN-7020-2
• USN-7028-1
• USN-7020-3
• USN-7020-4
• USN-7028-2
• USN-7110-1
• USN-7039-1
• USN-6949-1
• USN-6952-1
• USN-6955-1
• USN-6949-2