USN-7007-2: Linux kernel vulnerabilities

Releases

• Ubuntu 20.04 LTS

Packages

• linux-ibm-5.15 - Linux kernel for IBM cloud systems
• linux-oracle-5.15 - Linux kernel for Oracle Cloud systems

Details

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel
did not properly check for the device to be enabled before writing. A local
attacker could possibly use this to cause a denial of service.
(CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

• ARM64 architecture;
• M68K architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Accessibility subsystem;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• HW tracing;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Near Field Communication (NFC) drivers;
• NVME drivers;
• Pin controllers subsystem;
• PTP clock framework;
• S/390 drivers;
• SCSI drivers;
• SoundWire subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• JFFS2 file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• SMB network file system;
• IOMMU subsystem;
• Memory management;
• Netfilter;
• BPF subsystem;
• Kernel debugger infrastructure;
• DMA mapping infrastructure;
• IRQ subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• Multipath TCP;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• Wireless networking;
• XFRM subsystem;
• ALSA framework;
• SoC Audio for Freescale CPUs drivers;
• Kirkwood ASoC drivers;
  (CVE-2024-42140, CVE-2024-38580, CVE-2024-38555, CVE-2024-38591,
  CVE-2024-40942, CVE-2024-42130, CVE-2024-41095, CVE-2024-40994,
  CVE-2024-39469, CVE-2024-38610, CVE-2024-42097, CVE-2024-42137,
  CVE-2024-31076, CVE-2024-38552, CVE-2024-36489, CVE-2024-40983,
  CVE-2024-40908, CVE-2024-39493, CVE-2024-40970, CVE-2024-40901,
  CVE-2024-38567, CVE-2024-38599, CVE-2024-38605, CVE-2024-42119,
  CVE-2024-38590, CVE-2024-38558, CVE-2023-52884, CVE-2024-41000,
  CVE-2024-42101, CVE-2024-40943, CVE-2024-39507, CVE-2024-42115,
  CVE-2024-40968, CVE-2024-42095, CVE-2024-41034, CVE-2024-38618,
  CVE-2024-38633, CVE-2024-40904, CVE-2024-42070, CVE-2024-38583,
  CVE-2024-39471, CVE-2024-38578, CVE-2024-38637, CVE-2024-40987,
  CVE-2024-39506, CVE-2024-39482, CVE-2024-42124, CVE-2024-40981,
  CVE-2024-35927, CVE-2022-48772, CVE-2024-38588, CVE-2023-52887,
  CVE-2024-40941, CVE-2024-34027, CVE-2024-38627, CVE-2024-42106,
  CVE-2024-40927, CVE-2024-38559, CVE-2024-39499, CVE-2024-39505,
  CVE-2024-42120, CVE-2024-38615, CVE-2024-39467, CVE-2024-42232,
  CVE-2024-38589, CVE-2024-38621, CVE-2024-41002, CVE-2024-40934,
  CVE-2024-38582, CVE-2024-39480, CVE-2024-38571, CVE-2024-39301,
  CVE-2024-38612, CVE-2024-39495, CVE-2024-39276, CVE-2024-42096,
  CVE-2024-41041, CVE-2024-40912, CVE-2024-41089, CVE-2024-41093,
  CVE-2024-40931, CVE-2024-42092, CVE-2024-41047, CVE-2024-40956,
  CVE-2024-42229, CVE-2024-40914, CVE-2024-39490, CVE-2024-38548,
  CVE-2024-41044, CVE-2024-40967, CVE-2024-38596, CVE-2024-40902,
  CVE-2024-41055, CVE-2024-38601, CVE-2024-42153, CVE-2024-38623,
  CVE-2024-35247, CVE-2024-38635, CVE-2024-38662, CVE-2024-42086,
  CVE-2024-42102, CVE-2024-42154, CVE-2024-38587, CVE-2024-39466,
  CVE-2024-40911, CVE-2024-39503, CVE-2024-42090, CVE-2024-42087,
  CVE-2024-40929, CVE-2024-37078, CVE-2024-39489, CVE-2024-42244,
  CVE-2024-40980, CVE-2024-38624, CVE-2024-42105, CVE-2024-36270,
  CVE-2024-41092, CVE-2024-40937, CVE-2024-38780, CVE-2024-41035,
  CVE-2024-42104, CVE-2024-40988, CVE-2024-36894, CVE-2024-42157,
  CVE-2024-38613, CVE-2024-40916, CVE-2024-41040, CVE-2024-36032,
  CVE-2024-40978, CVE-2024-38579, CVE-2024-38550, CVE-2024-41049,
  CVE-2024-40959, CVE-2024-42131, CVE-2024-42161, CVE-2024-42247,
  CVE-2024-37356, CVE-2024-40905, CVE-2024-42098, CVE-2024-40932,
  CVE-2024-42236, CVE-2024-38565, CVE-2024-38661, CVE-2024-40963,
  CVE-2024-42240, CVE-2024-40984, CVE-2024-39277, CVE-2024-38573,
  CVE-2024-39509, CVE-2024-41006, CVE-2024-34777, CVE-2024-42152,
  CVE-2024-40954, CVE-2024-39501, CVE-2024-42109, CVE-2024-42080,
  CVE-2024-42225, CVE-2024-41007, CVE-2024-42077, CVE-2024-38634,
  CVE-2024-40995, CVE-2024-42084, CVE-2024-40974, CVE-2024-38586,
  CVE-2024-42224, CVE-2024-40960, CVE-2024-39500, CVE-2024-41004,
  CVE-2024-42145, CVE-2024-38619, CVE-2024-36974, CVE-2024-39502,
  CVE-2024-41097, CVE-2024-40958, CVE-2024-41027, CVE-2024-36972,
  CVE-2024-36286, CVE-2024-40990, CVE-2024-42082, CVE-2024-40945,
  CVE-2024-36014, CVE-2024-42068, CVE-2024-41087, CVE-2024-36978,
  CVE-2024-42148, CVE-2024-40971, CVE-2024-38546, CVE-2024-39488,
  CVE-2024-41048, CVE-2024-42121, CVE-2024-38381, CVE-2024-41046,
  CVE-2024-36971, CVE-2024-42085, CVE-2024-39487, CVE-2024-33847,
  CVE-2024-38607, CVE-2024-33621, CVE-2024-40957, CVE-2024-42127,
  CVE-2024-38547, CVE-2024-36015, CVE-2024-38549, CVE-2024-38597,
  CVE-2024-42093, CVE-2024-42089, CVE-2024-39468, CVE-2024-38560,
  CVE-2024-42223, CVE-2024-38659, CVE-2024-38598, CVE-2024-40976,
  CVE-2024-42094, CVE-2024-41005, CVE-2024-39475, CVE-2024-40961,
  CVE-2024-42076)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• linux-image-5.15.0-1062-ibm - 5.15.0-1062.65~20.04.1
• linux-image-5.15.0-1067-oracle - 5.15.0-1067.73~20.04.1
• linux-image-ibm - 5.15.0.1062.65~20.04.1
• linux-image-oracle - 5.15.0.1067.73~20.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

• CVE-2024-42229
• CVE-2024-39509
• CVE-2024-39471
• CVE-2024-34777
• CVE-2024-40958
• CVE-2024-41089
• CVE-2024-40970
• CVE-2024-38560
• CVE-2024-38612
• CVE-2024-38633
• CVE-2024-40929
• CVE-2024-42084
• CVE-2024-41049
• CVE-2024-36489
• CVE-2024-39487
• CVE-2024-38547
• CVE-2024-40990
• CVE-2024-39493
• CVE-2024-40908
• CVE-2024-41034
• CVE-2024-33621
• CVE-2024-38546
• CVE-2024-39488
• CVE-2024-40956
• CVE-2024-38558
• CVE-2024-38601
• CVE-2024-38555
• CVE-2024-40980
• CVE-2024-41002
• CVE-2024-42101
• CVE-2024-42130
• CVE-2024-40901
• CVE-2024-38637
• CVE-2024-40905
• CVE-2024-38588
• CVE-2024-42098
• CVE-2024-42152
• CVE-2024-40963
• CVE-2024-40927
• CVE-2024-42089
• CVE-2024-38580
• CVE-2024-38583
• CVE-2024-40959
• CVE-2024-40981
• CVE-2024-40983
• CVE-2024-40942
• CVE-2024-38586
• CVE-2024-38599
• CVE-2024-41087
• CVE-2024-35247
• CVE-2024-31076
• CVE-2024-38659
• CVE-2024-41048
• CVE-2024-41092
• CVE-2024-35927
• CVE-2024-36286
• CVE-2024-37078
• CVE-2024-36014
• CVE-2024-38607
• CVE-2024-42090
• CVE-2024-42154
• CVE-2024-42223
• CVE-2024-36972
• CVE-2024-42240
• CVE-2024-42120
• CVE-2024-41004
• CVE-2024-38661
• CVE-2024-42097
• CVE-2024-38582
• CVE-2024-42068
• CVE-2024-38610
• CVE-2024-41041
• CVE-2024-39277
• CVE-2024-42086
• CVE-2024-39467
• CVE-2024-40912
• CVE-2024-40971
• CVE-2024-40987
• CVE-2024-38579
• CVE-2024-39301
• CVE-2024-41007
• CVE-2024-40984
• CVE-2024-36270
• CVE-2024-39469
• CVE-2024-38619
• CVE-2024-39276
• CVE-2024-41095
• CVE-2024-38578
• CVE-2024-38635
• CVE-2024-40931
• CVE-2024-42093
• CVE-2024-42105
• CVE-2024-38621
• CVE-2024-39501
• CVE-2024-23848
• CVE-2024-42119
• CVE-2024-42153
• CVE-2024-41000
• CVE-2024-42131
• CVE-2024-38559
• CVE-2024-38550
• CVE-2024-41055
• CVE-2024-41097
• CVE-2024-38596
• CVE-2024-42115
• CVE-2024-38552
• CVE-2024-39503
• CVE-2024-41046
• CVE-2024-42124
• CVE-2024-42140
• CVE-2024-39475
• CVE-2024-41005
• CVE-2024-42082
• CVE-2022-48772
• CVE-2024-34027
• CVE-2024-36032
• CVE-2023-52884
• CVE-2023-52887
• CVE-2024-38381
• CVE-2024-42095
• CVE-2024-38627
• CVE-2024-38548
• CVE-2024-38589
• CVE-2024-38598
• CVE-2024-40957
• CVE-2024-42127
• CVE-2024-36894
• CVE-2024-42087
• CVE-2024-38613
• CVE-2024-39507
• CVE-2024-38567
• CVE-2024-42225
• CVE-2024-39468
• CVE-2024-40902
• CVE-2024-40943
• CVE-2024-40911
• CVE-2024-39505
• CVE-2024-38780
• CVE-2024-40934
• CVE-2024-41006
• CVE-2024-42076
• CVE-2024-38624
• CVE-2024-38615
• CVE-2024-42102
• CVE-2024-40932
• CVE-2024-39466
• CVE-2024-40945
• CVE-2024-42094
• CVE-2024-42109
• CVE-2024-40954
• CVE-2024-42161
• CVE-2024-42145
• CVE-2024-41093
• CVE-2024-42137
• CVE-2024-39495
• CVE-2024-39482
• CVE-2024-38565
• CVE-2024-42070
• CVE-2024-42106
• CVE-2024-42148
• CVE-2024-39506
• CVE-2024-42104
• CVE-2024-42085
• CVE-2024-39480
• CVE-2024-40995
• CVE-2024-38597
• CVE-2024-41047
• CVE-2024-38587
• CVE-2024-42121
• CVE-2024-36971
• CVE-2024-40914
• CVE-2024-40904
• CVE-2024-40968
• CVE-2024-39502
• CVE-2024-41044
• CVE-2024-41027
• CVE-2024-38623
• CVE-2024-39490
• CVE-2024-40960
• CVE-2024-42244
• CVE-2024-39489
• CVE-2024-38571
• CVE-2024-40961
• CVE-2024-42247
• CVE-2024-41040
• CVE-2024-40994
• CVE-2024-40967
• CVE-2024-40916
• CVE-2024-42096
• CVE-2024-42232
• CVE-2024-40937
• CVE-2024-38618
• CVE-2024-39500
• CVE-2024-38634
• CVE-2024-39499
• CVE-2024-42092
• CVE-2024-37356
• CVE-2024-38591
• CVE-2024-40976
• CVE-2024-38549
• CVE-2024-38573
• CVE-2024-40988
• CVE-2024-38590
• CVE-2024-40978
• CVE-2024-38662
• CVE-2024-42080
• CVE-2024-40941
• CVE-2024-36015
• CVE-2024-25741
• CVE-2024-42224
• CVE-2024-36974
• CVE-2024-42077
• CVE-2024-42157
• CVE-2024-42236
• CVE-2024-36978
• CVE-2024-38605
• CVE-2024-33847
• CVE-2024-41035
• CVE-2024-40974

Related notices

• USN-7007-1
• USN-7009-1
• USN-7019-1
• USN-7007-3
• USN-7009-2
• USN-7069-1
• USN-7069-2
• USN-7088-1
• USN-7089-1
• USN-7090-1
• USN-7088-2
• USN-7089-2
• USN-7088-3
• USN-7089-3
• USN-7095-1
• USN-7088-4
• USN-7110-1
• USN-7089-4
• USN-7089-5
• USN-7088-5
• USN-7089-6
• USN-7119-1
• USN-7089-7
• USN-6999-1
• USN-7003-1
• USN-7003-2
• USN-7004-1
• USN-7005-1
• USN-7006-1
• USN-7003-3
• USN-7005-2
• USN-7008-1
• USN-6999-2
• USN-7029-1
• USN-7003-4
• USN-7003-5
• USN-6953-1
• USN-6951-1
• USN-6951-2
• USN-6951-3
• USN-6951-4
• USN-6979-1
• USN-7121-1
• USN-7121-2
• USN-7121-3
• USN-7148-1
• USN-6949-1
• USN-6952-1
• USN-6955-1
• USN-6949-2
• USN-7028-1
• USN-7039-1
• USN-7028-2
• USN-6893-1
• USN-6893-2
• USN-6893-3
• USN-6917-1
• USN-6918-1
• USN-7020-1
• USN-7020-2
• USN-7020-3
• USN-7020-4