Critical Vulnerabilities in linux-oracle Package: Denial of Service and Information Exposure Risks
Summary
USN-5640-1: linux-oracle vulnerabilities. Affects linux-oracle versions < 5.15.0-1018.23. Fixed in 5.15.0-1018.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-oracle package is a version of the Linux kernel tailored for Oracle Cloud Infrastructure, providing essential functionalities for managing system resources and hardware interactions. It is a critical component for running applications and services on Oracle's infrastructure. However, recent vulnerabilities have been identified that could compromise system stability and security.
Vulnerability Detail
The vulnerabilities in the linux-oracle package stem from various issues, including improper memory handling, race conditions, and out-of-bounds writes. These flaws can lead to denial of service (system crashes) and potential exposure of sensitive information. Specific vulnerabilities include CVE-2021-33655, which allows local attackers to exploit framebuffer driver flaws, and multiple CVEs related to the Xen virtual block driver that could expose guest kernel memory.
How To Fix
Minimum fixed version
5.15.0-1018.23
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-oracleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected components or disable the Xen features if they are not in use. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The linux-oracle package has critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with denial of service and information exposure. Regular monitoring and vulnerability management practices are essential for maintaining system security.
See every vulnerability recorded for linux-oracle →
FAQ
The vulnerabilities can lead to system crashes and exposure of sensitive information, posing significant risks to system integrity and data security.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While many vulnerabilities are local, some may allow remote attackers to trigger denial of service conditions, especially those related to network handling.
If an immediate update is not possible, consider implementing workarounds such as limiting access to affected components or disabling unnecessary features.
Detailed information can be found in the Ubuntu Security Notices and the Common Vulnerabilities and Exposures (CVE) database.
Related vulnerabilities
Recent vulnerabilities recorded for linux-oracle.
