Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6416-1)

2023-10-0400:00:00

www.tenable.com

ipv6

syn flood

amd cpus

side channel

rpl protocol

denial of service

decnet

out-of-bounds read

nfc

use-after-free

siano smsusb

kvm

tun/tap

exfat

buffer overflow

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.1

Confidence

High

EPSS

0.021

Percentile

89.4%

JSON

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6416-1 advisory.

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash     collisions in connection lookup table. A remote attacker could use this to cause a denial of service     (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising     speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-     channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
(CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle     user-supplied data. A remote attacker could use this to cause a denial of service (system crash).
(CVE-2023-2156)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a     null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been     removed to resolve this CVE. (CVE-2023-3338)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38432)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability     when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to     cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).
(CVE-2023-3863)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a     buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could     use this to cause a denial of service (system crash) or possibly expose sensitive information.
(CVE-2023-3865)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer     dereference vulnerability when handling handling chained requests. A remote attacker could use this to     cause a denial of service (system crash). (CVE-2023-3866)

It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure     Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker     in a SEV guest VM could possibly use this to cause a denial of service (host system crash).
(CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A     local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly     check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to     construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

Thelford Williams discovered that the Ceph file system messenger protocol implementation in the Linux     kernel did not properly validate frame segment length in certain situation, leading to a buffer overflow     vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-44466)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-6416-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(182558);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/08/27");

  script_cve_id(
    "CVE-2023-1206",
    "CVE-2023-2156",
    "CVE-2023-3338",
    "CVE-2023-3863",
    "CVE-2023-3865",
    "CVE-2023-3866",
    "CVE-2023-4132",
    "CVE-2023-4155",
    "CVE-2023-4194",
    "CVE-2023-4273",
    "CVE-2023-20569",
    "CVE-2023-38432",
    "CVE-2023-44466"
  );
  script_xref(name:"USN", value:"6416-1");

  script_name(english:"Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6416-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as
referenced in the USN-6416-1 advisory.

    It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash
    collisions in connection lookup table. A remote attacker could use this to cause a denial of service
    (excessive CPU consumption). (CVE-2023-1206)

    Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising
    speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-
    channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
    (CVE-2023-20569)

    It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle
    user-supplied data. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2023-2156)

    Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a
    null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service
    (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been
    removed to resolve this CVE. (CVE-2023-3338)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate
    command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use
    this to cause a denial of service (system crash). (CVE-2023-38432)

    It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability
    when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to
    cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).
    (CVE-2023-3863)

    Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a
    buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could
    use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2023-3865)

    Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer
    dereference vulnerability when handling handling chained requests. A remote attacker could use this to
    cause a denial of service (system crash). (CVE-2023-3866)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly
    handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A
    physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure
    Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker
    in a SEV guest VM could possibly use this to cause a denial of service (host system crash).
    (CVE-2023-4155)

    It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A
    local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

    Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly
    check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to
    construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service
    (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

    Thelford Williams discovered that the Ceph file system messenger protocol implementation in the Linux
    kernel did not properly validate frame segment length in certain situation, leading to a buffer overflow
    vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly
    execute arbitrary code. (CVE-2023-44466)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-6416-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-38432");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/05/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/10/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1030-gkeop");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1037-nvidia");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1037-nvidia-lowlatency");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1040-ibm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1044-gcp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1045-oracle");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1047-aws");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-1049-azure-fde");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-86-generic");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-86-generic-64k");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-86-generic-lpae");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-86-lowlatency");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.15.0-86-lowlatency-64k");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2023-2024 Canonical, Inc. / NASL script (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');
include('ksplice.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('20.04' >< os_release || '22.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 20.04 / 22.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var kernel_mappings = {
  '20.04': {
    '5.15.0': {
      'lowlatency': '5.15.0-86',
      'lowlatency-64k': '5.15.0-86',
      'gkeop': '5.15.0-1030',
      'ibm': '5.15.0-1040',
      'gcp': '5.15.0-1044',
      'aws': '5.15.0-1047',
      'azure-fde': '5.15.0-1049'
    }
  },
  '22.04': {
    '5.15.0': {
      'generic': '5.15.0-86',
      'generic-64k': '5.15.0-86',
      'generic-lpae': '5.15.0-86',
      'gkeop': '5.15.0-1030',
      'nvidia': '5.15.0-1037',
      'nvidia-lowlatency': '5.15.0-1037',
      'ibm': '5.15.0-1040',
      'gcp': '5.15.0-1044',
      'oracle': '5.15.0-1045',
      'aws': '5.15.0-1047',
      'azure-fde': '5.15.0-1049'
    }
  }
};

var host_kernel_release = get_kb_item('Host/uptrack-uname-r');
if (empty_or_null(host_kernel_release)) host_kernel_release = get_kb_item_or_exit('Host/uname-r');
var host_kernel_base_version = get_kb_item_or_exit('Host/Debian/kernel-base-version');
var host_kernel_type = get_kb_item_or_exit('Host/Debian/kernel-type');
if(empty_or_null(kernel_mappings[os_release][host_kernel_base_version][host_kernel_type])) audit(AUDIT_INST_VER_NOT_VULN, 'kernel ' + host_kernel_release);

var extra = '';
var kernel_fixed_version = kernel_mappings[os_release][host_kernel_base_version][host_kernel_type] + "-" + host_kernel_type;
if (deb_ver_cmp(ver1:host_kernel_release, ver2:kernel_fixed_version) < 0)
{
  extra += 'Running Kernel level of ' + host_kernel_release + ' does not meet the minimum fixed level of ' + kernel_fixed_version + ' for this advisory.\n\n';
}
  else
{
  audit(AUDIT_PATCH_INSTALLED, 'Kernel package for USN-6416-1');
}

if (get_one_kb_item('Host/ksplice/kernel-cves'))
{
  var cve_list = make_list('CVE-2023-1206', 'CVE-2023-2156', 'CVE-2023-3338', 'CVE-2023-3863', 'CVE-2023-3865', 'CVE-2023-3866', 'CVE-2023-4132', 'CVE-2023-4155', 'CVE-2023-4194', 'CVE-2023-4273', 'CVE-2023-20569', 'CVE-2023-38432', 'CVE-2023-44466');
  if (ksplice_cves_check(cve_list))
  {
    audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for USN-6416-1');
  }
  else
  {
    extra = extra + ksplice_reporting_text();
  }
}
if (extra) {
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}