Critical Vulnerabilities in linux-oem-6.0: Elevation of Privileges and Denial of Service Risks
Summary
USN-6072-1: linux-oem-6.0 vulnerabilities. Affects linux-oem-6.0 versions < 6.0.0-1015.15. Fixed in 6.0.0-1015.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-oem-6.0 package is a variant of the Linux kernel tailored for OEM-specific hardware configurations. It provides essential functionalities for managing system resources and hardware interactions. However, recent vulnerabilities have been identified that could allow local attackers to exploit weaknesses in the kernel, potentially leading to elevated privileges or system crashes.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the linux-oem-6.0 package. These include a failure in the Traffic-Control Index (TCINDEX) implementation that could allow local attackers to gain elevated privileges (CVE-2023-1829). Additionally, a race condition in the io_uring subsystem could lead to a null pointer dereference, causing a denial of service (CVE-2023-0468). Other vulnerabilities include improper handling of copy-up operations in OverlayFS (CVE-2023-0386), a use-after-free issue in the Xen transport layer (CVE-2023-1859), a type confusion vulnerability in ATM VC queuing (CVE-2023-23455), and a double-free vulnerability in the MPLS implementation (CVE-2023-26545). These vulnerabilities could lead to system crashes, exposure of sensitive information, or arbitrary code execution.
How To Fix
Minimum fixed version
6.0.0-1015.15
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-oem-6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for these vulnerabilities. It is advisable to apply the patch as soon as possible to mitigate risks.
Conclusion
The linux-oem-6.0 package has several critical vulnerabilities that pose significant risks to system security. It is essential to update to the latest patched version to mitigate these risks. Regular monitoring and updating of packages are crucial for maintaining system integrity.
See every vulnerability recorded for linux-oem-6.0 →
FAQ
These vulnerabilities can lead to elevated privileges for local attackers, denial of service, and potential exposure of sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without any signup.
While the primary risks involve system crashes and privilege escalation, there is a potential for data loss if an attacker exploits these vulnerabilities.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux-oem-6.0.
