by 
Canonical released new Linux kernel security updates for Ubuntu 22.10, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS systems running Linux kernel 5.19 or Linux kernel 5.15 LTS to address up to 17 security vulnerabilities.
Coming three weeks after the previous Ubuntu kernel security updates, the new ones are here for Ubuntu 22.10 (Kinetic Kudu) and Ubuntu 22.04 LTS (Jammy Jellyfish) systems running Linux kernel 5.19, as well as Ubuntu 22.04 LTS (Jammy Jellyfish) and Ubuntu 20.04 LTS (Focal Fossa) systems running Linux kernel 5.15 LTS.
Of the 17 security vulnerabilities patched by these new kernel updates, 14 of them affect all the Ubuntu systems mentioned above. The most critical one is CVE-2022-4379, a use-after-free vulnerability discovered in the NFSD implementation that could allow a remote attacker to cause a denial of service (system crash) or execute arbitrary code.
Also patched are CVE-2023-0461, a use-after-free vulnerability discovered in the Upper Level Protocol (ULP) subsystem, CVE-2023-0179, a flaw discovered by Davide Ornaghi in the netfilter subsystem, CVE-2022-3545, a use-after-free vulnerability discovered in the Netronome Ethernet driver, CVE-2022-4139, a flaw found in the Intel i915 graphics driver. These vulnerabilities could allow a local attacker to cause a denial of service (system crash) or execute arbitrary code.
The same goes for CVE-2022-47518, CVE-2022-47519, CVE-2022-47520, and CVE-2022-47521, four security flaws discovered in the Atmel WILC1000 driver, which could lead to out-of-bounds write, out-of-bounds read, or heap-based buffer overflow vulnerabilities, allowing an attacker to cause a denial of service (system crash) or possibly execute arbitrary code.
Furthermore, the new Ubuntu kernel security updates patch CVE-2022-3169, a security issue found in the NVMe driver, and CVE-2022-3521, a race condition discovered in the Kernel Connection Multiplexor (KCM) socket implementation. These two flaws could allow a local attacker to cause a denial of service (system crash).
Ubuntu 22.10 (Kinetic Kudu) and Ubuntu 22.04 LTS (Jammy Jellyfish) systems running Linux kernel 5.19 were also affected by two KVM flaws, including CVE-2022-45869, a race condition in the x86 KVM subsystem implementation that could allow an attacker in a guest virtual machine to crash the host operating system by causing a denial of service, and CVE-2022-3344, a flaw discovered by Maxim Levitsky in the KVM nested virtualization (SVM) implementation for AMD processors that could allow an attacker in a guest VM to cause a denial of service (host kernel crash).
Last but not least, the new Ubuntu kernel updates fixed CVE-2022-3435, a race condition discovered by Gwangun Jung in the IPv4 implementation that could allow an attacker to cause a denial of service (system crash) or expose sensitive information (kernel memory).
Only for Ubuntu 22.04 LTS (Jammy Jellyfish) and Ubuntu 20.04 LTS (Focal Fossa) systems running Linux kernel 5.15 LTS, the new kernel security updates also patch CVE-2022-42328 and CVE-2022-42329, two race conditions discovered in the Xen network backend driver that could allow an attacker to cause a denial of service (kernel deadlock), as well as CVE-2023-0468, a race condition discovered by Lin Ma in the io_uring subsystem that could lead to a null pointer dereference vulnerability, allowing a local attacker to cause a denial of service (system crash).
Canonical urges all Ubuntu users to update their installations as soon as possible to the new kernel versions (linux-image 5.19.0-35.36 for Ubuntu 22.10 and Ubuntu 22.04 LTS systems running Linux kernel 5.19, linux-image 5.15.0.67.65 for Ubuntu 22.04 LTS systems running Linux kernel 5.15 LTS, linux-image 5.15.0.67.74~20.04.28 for Ubuntu 20.04 LTS systems running Linux kernel 5.15 LTS).
To update your Ubuntu installations, run the sudo apt update && sudo apt full-upgrade command in the Terminal app or use the Software Updater utility. Don’t forget to reboot your systems after installing the new kernel versions, as well as to rebuild and reinstall any third-party kernel modules you might have installed.
Update: New kernel security updates have also been released for Ubuntu 20.04 LTS systems running Linux kernel 5.4 LTS for NVIDIA BlueField platforms, as well as Ubuntu 20.04 LTS and Ubuntu 18.04 LTS systems running Linux kernel 5.4 LTS and Ubuntu 18.04 LTS systems running Linux kernel 4.15.
Last updated 1 year ago
