🛡️ USN-6261-1 — linux-iot

linux-iot vulnerabilities

It was discovered that the IP-VLAN network driver for the Linux kernel did

not properly initialize memory in some situations, leading to an out-of-

bounds write vulnerability. An attacker could use this to cause a denial of

service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in

the Ubuntu Linux kernel did not properly perform permission checks in

certain situations. A local attacker could possibly use this to gain

elevated privileges. (CVE-2023-32629)

It was discovered that the netfilter subsystem in the Linux kernel did not

properly handle some error conditions, leading to a use-after-free

vulnerability. A local attacker could use this to cause a denial of service

(system crash) or possibly execute arbitrary code. (CVE-2023-3390)

Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel

did not properly handle certain pointer data type, leading to an out-of-

bounds write vulnerability. A privileged attacker could use this to cause a

denial of service (system crash) or possibly execute arbitrary code.

(CVE-2023-35001)