ID

VAR-202203-0045

CVE

CVE-2022-0001

TITLE

Linux kernel on Intel systems is susceptible to Spectre v2 attacks

DESCRIPTION

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. A new cross-privilege Spectre v2 vulnerability that impacts modern CPU architectures supporting speculative execution has been discovered. CPU hardware utilizing speculative execution that are vulnerable to Spectre v2 branch history injection (BHI) are likely affected. An unauthenticated attacker can exploit this vulnerability to leak privileged memory from the CPU by speculatively jumping to a chosen gadget. Current research shows that existing mitigation techniques of disabling privileged eBPF and enabling (Fine)IBT are insufficient in stopping BHI exploitation against the kernel/hypervisor.CVE-2022-0001 Not Affected CVE-2024-2201 AffectedCVE-2022-0001 Not Affected CVE-2024-2201 Affected. A flaw was found in hw. The Branch History Injection (BHI) describes a specific form of intra-mode BTI. This flaw allows an unprivileged malicious user to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to select a specific predictor entry for an indirect branch, and a disclosure gadget at the predicted target will transiently execute. This execution is possible since the relevant branch history may contain branches taken in previous security contexts, and in particular, in other predictor modes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Advanced Cluster Management 2.4.5 security updates and bug fixes Advisory ID: RHSA-2022:5201-01 Product: Red Hat ACM Advisory URL: https://access.redhat.com/errata/RHSA-2022:5201 Issue date: 2022-06-27 CVE Names: CVE-2018-25032 CVE-2020-0404 CVE-2020-4788 CVE-2020-13974 CVE-2020-19131 CVE-2020-27820 CVE-2021-0941 CVE-2021-3612 CVE-2021-3634 CVE-2021-3669 CVE-2021-3695 CVE-2021-3696 CVE-2021-3697 CVE-2021-3737 CVE-2021-3743 CVE-2021-3744 CVE-2021-3752 CVE-2021-3759 CVE-2021-3764 CVE-2021-3772 CVE-2021-3773 CVE-2021-4002 CVE-2021-4037 CVE-2021-4083 CVE-2021-4157 CVE-2021-4189 CVE-2021-4197 CVE-2021-4203 CVE-2021-20322 CVE-2021-21781 CVE-2021-25219 CVE-2021-26401 CVE-2021-29154 CVE-2021-37159 CVE-2021-38185 CVE-2021-41617 CVE-2021-41864 CVE-2021-42739 CVE-2021-43056 CVE-2021-43389 CVE-2021-43565 CVE-2021-43976 CVE-2021-44733 CVE-2021-45485 CVE-2021-45486 CVE-2022-0001 CVE-2022-0002 CVE-2022-0286 CVE-2022-0322 CVE-2022-1011 CVE-2022-1271 CVE-2022-21803 CVE-2022-23806 CVE-2022-24450 CVE-2022-24785 CVE-2022-25645 CVE-2022-28733 CVE-2022-28734 CVE-2022-28735 CVE-2022-28736 CVE-2022-28737 CVE-2022-29526 CVE-2022-29810 ===================================================================== 1. Summary: Red Hat Advanced Cluster Management for Kubernetes 2.4.5 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. 2. Description: Red Hat Advanced Cluster Management for Kubernetes 2.4.5 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which apply security fixes and fix several bugs. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.4/html/release_notes/ Security fixes: * golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565) * nconf: Prototype pollution in memory store (CVE-2022-21803) * golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806) * nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account (CVE-2022-24450) * Moment.js: Path traversal in moment.locale (CVE-2022-24785) * dset: Prototype Pollution in dset (CVE-2022-25645) * golang: syscall: faccessat checks wrong group (CVE-2022-29526) * go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses (CVE-2022-29810) Bug fixes: * Trying to create a new cluster on vSphere and no feedback, stuck in "creating" (BZ# 1937078) * Wrong message is displayed when GRC fails to connect to an Ansible Tower (BZ# 2051752) * multicluster_operators_hub_subscription issues due to /tmp usage (BZ# 2052702) * Create Cluster, Worker Pool 2 zones do not load options that relate to the selected Region field (BZ# 2054954) * Changing the multiclusterhub name other than the default name keeps the version in the web console loading (BZ# 2059822) * search-redisgraph-0 generating massive amount of logs after 2.4.2 upgrade (BZ# 2065318) * Uninstall pod crashed when destroying Azure Gov cluster in ACM (BZ# 2073562) * Deprovisioned clusters not filtered out by discovery controller (BZ# 2075594) * When deleting a secret for a Helm application, duplicate errors show up in topology (BZ# 2075675) * Changing existing placement rules does not change YAML file Regression (BZ# 2075724) * Editing Helm Argo Applications does not Prune Old Resources (BZ# 2079906) * Failed to delete the requested resource [404] error appears after subscription is deleted and its placement rule is used in the second subscription (BZ# 2080713) * Typo in the logs when Deployable is updated in the subscription namespace (BZ# 2080960) * After Argo App Sets are created in an Upgraded Environment, the Clusters column does not indicate the clusters (BZ# 2080716) * RHACM 2.4.5 images (BZ# 2081438) * Performance issue to get secret in claim-controller (BZ# 2081908) * Failed to provision openshift 4.10 on bare metal (BZ# 2094109) 3. Solution: For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on installing this update: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.5/html-single/install/index#installing 4. Bugs fixed (https://bugzilla.redhat.com/): 1937078 - Trying to create a new cluster on vSphere and no feedback, stuck in "creating" 2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic 2051752 - Wrong message is displayed when GRC fails to connect to an ansible tower 2052573 - CVE-2022-24450 nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account 2052702 - multicluster_operators_hub_subscription issues due to /tmp usage 2053429 - CVE-2022-23806 golang: crypto/elliptic IsOnCurve returns true for invalid field elements 2054954 - Create Cluster, Worker Pool 2 zones do not load options that relate to the selected Region field 2059822 - Changing the multiclusterhub name other than the default name keeps the version in the web console loading. 2065318 - search-redisgraph-0 generating massive amount of logs after 2.4.2 upgrade 2072009 - CVE-2022-24785 Moment.js: Path traversal in moment.locale 2073562 - Uninstall pod crashed when destroying Azure Gov cluster in ACM 2074689 - CVE-2022-21803 nconf: Prototype pollution in memory store 2075594 - Deprovisioned clusters not filtered out by discovery controller 2075675 - When deleting a secret for a Helm application, duplicate errors show up in topology 2075724 - Changing existing placement rules does not change YAML file 2079906 - Editing Helm Argo Applications does not Prune Old Resources 2080279 - CVE-2022-29810 go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses 2080713 - Failed to delete the requested resource [404] error appears after subscription is deleted and it's placement rule is used in the second subscription [Upgrade] 2080716 - After Argo App Sets are created in an Upgraded Environment, the Clusters column does not indicate the clusters 2080847 - CVE-2022-25645 dset: Prototype Pollution in dset 2080960 - Typo in the logs when Deployable is updated in the subscription namespace 2081438 - RHACM 2.4.5 images 2081908 - Performance issue to get secret in claim-controller 2084085 - CVE-2022-29526 golang: syscall: faccessat checks wrong group 2094109 - Failed to provision openshift 4.10 on bare metal 5. References: https://access.redhat.com/security/cve/CVE-2018-25032 https://access.redhat.com/security/cve/CVE-2020-0404 https://access.redhat.com/security/cve/CVE-2020-4788 https://access.redhat.com/security/cve/CVE-2020-13974 https://access.redhat.com/security/cve/CVE-2020-19131 https://access.redhat.com/security/cve/CVE-2020-27820 https://access.redhat.com/security/cve/CVE-2021-0941 https://access.redhat.com/security/cve/CVE-2021-3612 https://access.redhat.com/security/cve/CVE-2021-3634 https://access.redhat.com/security/cve/CVE-2021-3669 https://access.redhat.com/security/cve/CVE-2021-3695 https://access.redhat.com/security/cve/CVE-2021-3696 https://access.redhat.com/security/cve/CVE-2021-3697 https://access.redhat.com/security/cve/CVE-2021-3737 https://access.redhat.com/security/cve/CVE-2021-3743 https://access.redhat.com/security/cve/CVE-2021-3744 https://access.redhat.com/security/cve/CVE-2021-3752 https://access.redhat.com/security/cve/CVE-2021-3759 https://access.redhat.com/security/cve/CVE-2021-3764 https://access.redhat.com/security/cve/CVE-2021-3772 https://access.redhat.com/security/cve/CVE-2021-3773 https://access.redhat.com/security/cve/CVE-2021-4002 https://access.redhat.com/security/cve/CVE-2021-4037 https://access.redhat.com/security/cve/CVE-2021-4083 https://access.redhat.com/security/cve/CVE-2021-4157 https://access.redhat.com/security/cve/CVE-2021-4189 https://access.redhat.com/security/cve/CVE-2021-4197 https://access.redhat.com/security/cve/CVE-2021-4203 https://access.redhat.com/security/cve/CVE-2021-20322 https://access.redhat.com/security/cve/CVE-2021-21781 https://access.redhat.com/security/cve/CVE-2021-25219 https://access.redhat.com/security/cve/CVE-2021-26401 https://access.redhat.com/security/cve/CVE-2021-29154 https://access.redhat.com/security/cve/CVE-2021-37159 https://access.redhat.com/security/cve/CVE-2021-38185 https://access.redhat.com/security/cve/CVE-2021-41617 https://access.redhat.com/security/cve/CVE-2021-41864 https://access.redhat.com/security/cve/CVE-2021-42739 https://access.redhat.com/security/cve/CVE-2021-43056 https://access.redhat.com/security/cve/CVE-2021-43389 https://access.redhat.com/security/cve/CVE-2021-43565 https://access.redhat.com/security/cve/CVE-2021-43976 https://access.redhat.com/security/cve/CVE-2021-44733 https://access.redhat.com/security/cve/CVE-2021-45485 https://access.redhat.com/security/cve/CVE-2021-45486 https://access.redhat.com/security/cve/CVE-2022-0001 https://access.redhat.com/security/cve/CVE-2022-0002 https://access.redhat.com/security/cve/CVE-2022-0286 https://access.redhat.com/security/cve/CVE-2022-0322 https://access.redhat.com/security/cve/CVE-2022-1011 https://access.redhat.com/security/cve/CVE-2022-1271 https://access.redhat.com/security/cve/CVE-2022-21803 https://access.redhat.com/security/cve/CVE-2022-23806 https://access.redhat.com/security/cve/CVE-2022-24450 https://access.redhat.com/security/cve/CVE-2022-24785 https://access.redhat.com/security/cve/CVE-2022-25645 https://access.redhat.com/security/cve/CVE-2022-28733 https://access.redhat.com/security/cve/CVE-2022-28734 https://access.redhat.com/security/cve/CVE-2022-28735 https://access.redhat.com/security/cve/CVE-2022-28736 https://access.redhat.com/security/cve/CVE-2022-28737 https://access.redhat.com/security/cve/CVE-2022-29526 https://access.redhat.com/security/cve/CVE-2022-29810 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYrpMwtzjgjWX9erEAQjpNBAAojYFQ2xqCBz/oyUXwGa5Z9S7DMVcDWkY 739hNxw16fLEyZ+exPG99RqymQqtN/pGsuYlNp8qgLcRE49qcLuHUrBESQE5B+jA nloxxZPPyadkgZ4hW7c2mNPwJ0kxRbWKzoLM2ItXChnJ5AxsegtuTjUYRAd6ULym j05rvJSnRKkMrdYCKZRlVjkGEUPq7Y1mBdRBrCSiFnMWJIeffyLxjdvSK1r9wV3T 7RSwAYJw1ygUmXvsqlx7jC0P+rVFrIVDbb/c+/HDc5LoQ7kVs4OMhy+onb+u1gaf G4qGuMHxq2UMmsebROP7Oues250wTgnML8Cfz+7JtO54BVKIpgWu7t5wx01RHKPR xiux74Ole7SEA+eKVooDUaT8BD35Xm0tT1yVhy++5crDlrGU7/IAgOyUbQLsfhmr xCDF3SNpbQZhclYc2pgEzgV9FHn2kEgV1Zk5VeeDaP2EWGJcT1gU5BfY8NOXuVM3 boPs6QuGZpDTYC+xD0i/W3TywuLzRcyTZq3nzi2hiW1rDdkJQasrgvIsw4emUOnv /mSyZZkC0jWnCJ1GiOcGuDDReqJo5UD3M2FYD23uJiPpEVDTp02DmrbW9r+8pU9D mp8U9kpnkphyAlYGzAz1DpfxUcTWt0jalqejG/VlaqDVhsY9bynqGj9U9cDWWubx dWwV9H3BFpY= =diO0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/ Security fixes: * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) * nconf: Prototype pollution in memory store (CVE-2022-21803) * golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806) * Moment.js: Path traversal in moment.locale (CVE-2022-24785) * golang: syscall: faccessat checks wrong group (CVE-2022-29526) * go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses (CVE-2022-29810) Bug fixes: * RHACM 2.3.11 images (BZ# 2082087) 3. Bugs fixed (https://bugzilla.redhat.com/): 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak 2053429 - CVE-2022-23806 golang: crypto/elliptic IsOnCurve returns true for invalid field elements 2072009 - CVE-2022-24785 Moment.js: Path traversal in moment.locale 2074689 - CVE-2022-21803 nconf: Prototype pollution in memory store 2080279 - CVE-2022-29810 go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses 2082087 - RHACM 2.3.11 images 2084085 - CVE-2022-29526 golang: syscall: faccessat checks wrong group 5. Summary: The Migration Toolkit for Containers (MTC) 1.6.5 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Security Fix(es): * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807) * golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2006044 - CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) 2007557 - CVE-2021-3807 nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes 2057579 - [MTC UI] Cancel button on ?Migrations? page does not disappear when migration gets Failed/Succeeded with warnings 2072311 - HPAs of DeploymentConfigs are not being updated when migration from Openshift 3.x to Openshift 4.x 2074044 - [MTC] Rsync pods are not running as privileged 2074553 - Upstream Hook Runner image requires arguments be in a different order 5. ========================================================================== Ubuntu Security Notice USN-6766-1 May 07, 2024 linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-azure: Linux kernel for Microsoft Azure Cloud systems - linux-azure-fde: Linux kernel for Microsoft Azure CVM cloud systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-ibm: Linux kernel for IBM cloud systems - linux-kvm: Linux kernel for cloud environments - linux-lowlatency: Linux low latency kernel - linux-nvidia: Linux kernel for NVIDIA systems - linux-oracle: Linux kernel for Oracle Cloud systems - linux-azure-5.15: Linux kernel for Microsoft Azure cloud systems - linux-azure-fde-5.15: Linux kernel for Microsoft Azure CVM cloud systems - linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems - linux-ibm-5.15: Linux kernel for IBM cloud systems - linux-lowlatency-hwe-5.15: Linux low latency kernel - linux-oracle-5.15: Linux kernel for Oracle Cloud systems Details: It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. (CVE-2024-23849) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Core kernel; - Block layer subsystem; - Android drivers; - Power management core; - Bus devices; - Hardware random number generator core; - Cryptographic API; - Device frequency; - DMA engine subsystem; - ARM SCMI message protocol; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Media drivers; - Network drivers; - PCI driver for MicroSemi Switchtec; - PHY drivers; - SCSI drivers; - DesignWare USB3 driver; - BTRFS file system; - Ceph distributed file system; - Ext4 file system; - F2FS file system; - JFS file system; - NILFS2 file system; - NTFS3 file system; - Pstore file system; - SMB network file system; - Memory management; - CAN network layer; - Networking core; - HSR network protocol; - IPv4 networking; - IPv6 networking; - Logical Link layer; - Multipath TCP; - Netfilter; - NFC subsystem; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - Unix domain sockets; - Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS linux-image-5.15.0-1044-gkeop 5.15.0-1044.51 linux-image-5.15.0-1054-ibm 5.15.0-1054.57 linux-image-5.15.0-1054-nvidia 5.15.0-1054.55 linux-image-5.15.0-1054-nvidia-lowlatency 5.15.0-1054.55 linux-image-5.15.0-1058-gke 5.15.0-1058.63 linux-image-5.15.0-1058-kvm 5.15.0-1058.63 linux-image-5.15.0-1059-gcp 5.15.0-1059.67 linux-image-5.15.0-1059-oracle 5.15.0-1059.65 linux-image-5.15.0-106-generic 5.15.0-106.116 linux-image-5.15.0-106-generic-64k 5.15.0-106.116 linux-image-5.15.0-106-generic-lpae 5.15.0-106.116 linux-image-5.15.0-106-lowlatency 5.15.0-106.116 linux-image-5.15.0-106-lowlatency-64k 5.15.0-106.116 linux-image-5.15.0-1063-azure 5.15.0-1063.72 linux-image-5.15.0-1063-azure-fde 5.15.0-1063.72.1 linux-image-azure-fde-lts-22.04 5.15.0.1063.72.41 linux-image-azure-lts-22.04 5.15.0.1063.61 linux-image-gcp-lts-22.04 5.15.0.1059.55 linux-image-generic 5.15.0.106.106 linux-image-generic-64k 5.15.0.106.106 linux-image-generic-lpae 5.15.0.106.106 linux-image-gke 5.15.0.1058.57 linux-image-gke-5.15 5.15.0.1058.57 linux-image-gkeop 5.15.0.1044.43 linux-image-gkeop-5.15 5.15.0.1044.43 linux-image-ibm 5.15.0.1054.50 linux-image-kvm 5.15.0.1058.54 linux-image-lowlatency 5.15.0.106.101 linux-image-lowlatency-64k 5.15.0.106.101 linux-image-nvidia 5.15.0.1054.54 linux-image-nvidia-lowlatency 5.15.0.1054.54 linux-image-oracle-lts-22.04 5.15.0.1059.55 linux-image-virtual 5.15.0.106.106 Ubuntu 20.04 LTS linux-image-5.15.0-1044-gkeop 5.15.0-1044.51~20.04.1 linux-image-5.15.0-1054-ibm 5.15.0-1054.57~20.04.1 linux-image-5.15.0-1059-gcp 5.15.0-1059.67~20.04.1 linux-image-5.15.0-1059-oracle 5.15.0-1059.65~20.04.1 linux-image-5.15.0-106-lowlatency 5.15.0-106.116~20.04.1 linux-image-5.15.0-106-lowlatency-64k 5.15.0-106.116~20.04.1 linux-image-5.15.0-1063-azure 5.15.0-1063.72~20.04.1 linux-image-5.15.0-1063-azure-fde 5.15.0-1063.72~20.04.1.1 linux-image-azure 5.15.0.1063.72~20.04.1 linux-image-azure-cvm 5.15.0.1063.72~20.04.1 linux-image-azure-fde 5.15.0.1063.72~20.04.1.41 linux-image-gcp 5.15.0.1059.67~20.04.1 linux-image-gkeop-5.15 5.15.0.1044.51~20.04.1 linux-image-ibm 5.15.0.1054.57~20.04.1 linux-image-lowlatency-64k-hwe-20.04 5.15.0.106.116~20.04.1 linux-image-lowlatency-hwe-20.04 5.15.0.106.116~20.04.1 linux-image-oracle 5.15.0.1059.65~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5095-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso March 09, 2022 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : linux CVE ID : CVE-2020-36310 CVE-2022-0001 CVE-2022-0002 CVE-2022-0487 CVE-2022-0492 CVE-2022-0617 CVE-2022-25636 Debian Bug : 990279 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2020-36310 A flaw was discovered in the KVM implementation for AMD processors, which could lead to an infinite loop. A malicious VM guest could exploit this to cause a denial of service. CVE-2022-0001 (INTEL-SA-00598) Researchers at VUSec discovered that the Branch History Buffer in Intel processors can be exploited to create information side- channels with speculative execution. This issue is similar to Spectre variant 2, but requires additional mitigations on some processors. This can be exploited to obtain sensitive information from a different security context, such as from user-space to the kernel, or from a KVM guest to the kernel. CVE-2022-0002 (INTEL-SA-00598) This is a similar issue to CVE-2022-0001, but covers exploitation within a security context, such as from JIT-compiled code in a sandbox to hosting code in the same process. This is partly mitigated by disabling eBPF for unprivileged users with the sysctl: kernel.unprivileged_bpf_disabled=2. This is already the default in Debian 11 "bullseye". CVE-2022-0487 A use-after-free was discovered in the MOXART SD/MMC Host Controller support driver. This flaw does not impact the Debian binary packages as CONFIG_MMC_MOXART is not set. CVE-2022-0492 Yiqi Sun and Kevin Wang reported that the cgroup-v1 subsystem does not properly restrict access to the release-agent feature. A local user can take advantage of this flaw for privilege escalation and bypass of namespace isolation. CVE-2022-0617 butt3rflyh4ck discovered a NULL pointer dereference in the UDF filesystem. A local user that can mount a specially crafted UDF image can use this flaw to crash the system. CVE-2022-25636 Nick Gregory reported a heap out-of-bounds write flaw in the netfilter subsystem. A user with the CAP_NET_ADMIN capability could use this for denial of service or possibly for privilege escalation. For the stable distribution (bullseye), these problems have been fixed in version 5.10.103-1. This update additionally includes many more bug fixes from stable updates 5.10.93-5.10.103 inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIotmRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Qajw//WLCg/HhmykP7eobsnnn7A0U0ONBbZi+Un6Ltueaambvlhme54l5eR4uh f8fLSehpKhEN4bzfWRnDe0vKbws557zsNnd+a000ylfkO6BqEoNL8VwMp0yOVvUt +nB39/ySIM1inH375JAWZ5M2+H8YJVBPrlm0kGxUtBwObC279atwGUINov4xrI5C RzcNa/FQ7tjUMaeBgdGAAJPImnP+zT6shhCUTlR5QLhvB9gyvthtb/OtvhbMcWlM 5gd7papoMFgWBspN21+NPmbadSEXDIpeyPanpfKu9S8Zmht69rTS+pEim6Hm682q 64m/Fb4NgCBgVUH9o8+QJUvJkHv8Z/lNDyfjSn90Eu7kcALDBqh/n+Y0q+SEwKhZ b6UPzuH+hObZk+7GDUY32t9JwlNu0qUk55nCufLVM01bVYkN5ukaXAWCyuCU83ky yY/nHRNHVISFuy6mdfiFRR7lvMcgBD0IPoU9T+cpZPl+WkwzEwyHx16RN/EDVlo6 NomcMiX07XRSwSG7h7wgFs+YxCv9TjvBoAqKS9Q7GwBX6lunItWMwz44+DxcW9SM lJPHFMju9hmqMBHI+UTUX8FMY9aq8Qyk+WFthl7eDZjOJ+lKtkEpTR3b50FXzbdc lTYZEMcNtr7AlThbIxH564DntN8YV3DCV4+Ba/DozvxSJ6kSmrA= =DHkG -----END PGP SIGNATURE----- . (CVE-2022-0001, CVE-2022-0002) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: linux-image-5.4.0-1017-ibm 5.4.0-1017.19 linux-image-5.4.0-1030-bluefield 5.4.0-1030.33 linux-image-5.4.0-1036-gkeop 5.4.0-1036.37 linux-image-5.4.0-104-generic 5.4.0-104.118 linux-image-5.4.0-104-generic-lpae 5.4.0-104.118 linux-image-5.4.0-104-lowlatency 5.4.0-104.118 linux-image-5.4.0-1055-raspi 5.4.0-1055.62 linux-image-5.4.0-1058-kvm 5.4.0-1058.61 linux-image-5.4.0-1065-gke 5.4.0-1065.68 linux-image-5.4.0-1066-oracle 5.4.0-1066.71 linux-image-5.4.0-1067-gcp 5.4.0-1067.71 linux-image-5.4.0-1068-aws 5.4.0-1068.72 linux-image-5.4.0-1072-azure 5.4.0-1072.75 linux-image-5.4.0-1072-azure-fde 5.4.0-1072.75+cvm1.1 linux-image-aws-lts-20.04 5.4.0.1068.70 linux-image-azure-fde 5.4.0.1072.75+cvm1.18 linux-image-azure-lts-20.04 5.4.0.1072.70 linux-image-bluefield 5.4.0.1030.31 linux-image-gcp-lts-20.04 5.4.0.1067.76 linux-image-generic 5.4.0.104.108 linux-image-generic-lpae 5.4.0.104.108 linux-image-gke 5.4.0.1065.75 linux-image-gke-5.4 5.4.0.1065.75 linux-image-gkeop 5.4.0.1036.39 linux-image-gkeop-5.4 5.4.0.1036.39 linux-image-ibm 5.4.0.1017.17 linux-image-ibm-lts-20.04 5.4.0.1017.17 linux-image-kvm 5.4.0.1058.57 linux-image-lowlatency 5.4.0.104.108 linux-image-oem 5.4.0.104.108 linux-image-oem-osp1 5.4.0.104.108 linux-image-oracle-lts-20.04 5.4.0.1066.66 linux-image-raspi 5.4.0.1055.89 linux-image-raspi2 5.4.0.1055.89 linux-image-virtual 5.4.0.104.108 Ubuntu 18.04 LTS: linux-image-5.4.0-1017-ibm 5.4.0-1017.19~18.04.1 linux-image-5.4.0-1036-gkeop 5.4.0-1036.37~18.04.1 linux-image-5.4.0-104-generic 5.4.0-104.118~18.04.1 linux-image-5.4.0-104-generic-lpae 5.4.0-104.118~18.04.1 linux-image-5.4.0-104-lowlatency 5.4.0-104.118~18.04.1 linux-image-5.4.0-1055-raspi 5.4.0-1055.62~18.04.1 linux-image-5.4.0-1065-gke 5.4.0-1065.68~18.04.1 linux-image-5.4.0-1066-oracle 5.4.0-1066.71~18.04.1 linux-image-5.4.0-1067-gcp 5.4.0-1067.71~18.04.1 linux-image-5.4.0-1068-aws 5.4.0-1068.72~18.04.1 linux-image-5.4.0-1072-azure 5.4.0-1072.75~18.04.1 linux-image-aws 5.4.0.1068.50 linux-image-azure 5.4.0.1072.51 linux-image-gcp 5.4.0.1067.52 linux-image-generic-hwe-18.04 5.4.0.104.118~18.04.89 linux-image-generic-lpae-hwe-18.04 5.4.0.104.118~18.04.89 linux-image-gke-5.4 5.4.0.1065.68~18.04.29 linux-image-gkeop-5.4 5.4.0.1036.37~18.04.36 linux-image-ibm 5.4.0.1017.34 linux-image-lowlatency-hwe-18.04 5.4.0.104.118~18.04.89 linux-image-oem 5.4.0.104.118~18.04.89 linux-image-oem-osp1 5.4.0.104.118~18.04.89 linux-image-oracle 5.4.0.1066.71~18.04.45 linux-image-raspi-hwe-18.04 5.4.0.1055.57 linux-image-snapdragon-hwe-18.04 5.4.0.104.118~18.04.89 linux-image-virtual-hwe-18.04 5.4.0.104.118~18.04.89 IMPORTANT: As part of this update, unprivileged eBPF is being disabled by default, as it is the primary known means of exploiting the Branch History Injection issues described above. It should be noted that other mechanisms for exploiting the underlying issues may be discovered. Also, this may cause issues for applications that rely on the unprivileged eBPF functionality. Please see the knowledge base article at https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/BHI for more details. After a standard system update you need to reboot your computer to make all the necessary changes

AFFECTED PRODUCTS