Critical Vulnerabilities in linux-oracle Package: USN-5599-1 Summary
Summary
USN-5599-1: linux-oracle vulnerabilities. Affects linux-oracle versions < 5.15.0-1017.22. Fixed in 5.15.0-1017.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-oracle package is a variant of the Linux kernel tailored for Oracle Cloud Infrastructure. It provides essential functionalities for managing hardware and software resources, ensuring optimal performance and security. However, recent vulnerabilities have been identified that could compromise system integrity and availability.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the linux-oracle package, including insufficient control flow management in the ixgbe Ethernet driver (CVE-2021-33061), inadequate randomization in IP implementation (CVE-2022-1012), and a race condition in the perf subsystem leading to use-after-free vulnerabilities (CVE-2022-1729). These vulnerabilities could allow local attackers to cause denial of service, execute arbitrary code, or expose sensitive information, posing significant risks to system stability and security.
How To Fix
Minimum fixed version
5.15.0-1017.22
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-oracleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. It is highly recommended to apply the patch as soon as possible to mitigate risks.
Conclusion
The linux-oracle package has critical vulnerabilities that need immediate attention. Updating to the latest patched version is essential to safeguard your system against potential attacks. Regular monitoring and updates are crucial for maintaining security.
See every vulnerability recorded for linux-oracle →
FAQ
The linux-oracle package is a specialized version of the Linux kernel designed for Oracle Cloud Infrastructure, providing essential functionalities for resource management.
The vulnerabilities could lead to denial of service, arbitrary code execution, or exposure of sensitive information, compromising system security and stability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Currently, there are no specific workarounds available. The best course of action is to apply the patch as soon as it is available.
It is advisable to regularly check for updates, especially after security advisories are released, to ensure your system remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for linux-oracle.
