Ubuntu: (Multiple Advisories) (CVE-2023-52449): Linux kernel (OEM) vulnerabilities
Description
In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME.
Solution(s)
- ubuntu-upgrade-linux-image-5-15-0-102-generic
- ubuntu-upgrade-linux-image-5-15-0-102-generic-64k
- ubuntu-upgrade-linux-image-5-15-0-102-generic-lpae
- ubuntu-upgrade-linux-image-5-15-0-102-lowlatency
- ubuntu-upgrade-linux-image-5-15-0-102-lowlatency-64k
- ubuntu-upgrade-linux-image-5-15-0-1040-gkeop
- ubuntu-upgrade-linux-image-5-15-0-1048-nvidia
- ubuntu-upgrade-linux-image-5-15-0-1048-nvidia-lowlatency
- ubuntu-upgrade-linux-image-5-15-0-1050-ibm
- ubuntu-upgrade-linux-image-5-15-0-1050-raspi
- ubuntu-upgrade-linux-image-5-15-0-1052-intel-iotg
- ubuntu-upgrade-linux-image-5-15-0-1054-gke
- ubuntu-upgrade-linux-image-5-15-0-1054-kvm
- ubuntu-upgrade-linux-image-5-15-0-1055-gcp
- ubuntu-upgrade-linux-image-5-15-0-1055-oracle
- ubuntu-upgrade-linux-image-5-15-0-1057-aws
- ubuntu-upgrade-linux-image-5-15-0-1060-azure
- ubuntu-upgrade-linux-image-5-15-0-1060-azure-fde
- ubuntu-upgrade-linux-image-5-4-0-1034-iot
- ubuntu-upgrade-linux-image-5-4-0-1041-xilinx-zynqmp
- ubuntu-upgrade-linux-image-5-4-0-1069-ibm
- ubuntu-upgrade-linux-image-5-4-0-1082-bluefield
- ubuntu-upgrade-linux-image-5-4-0-1089-gkeop
- ubuntu-upgrade-linux-image-5-4-0-1106-raspi
- ubuntu-upgrade-linux-image-5-4-0-1110-kvm
- ubuntu-upgrade-linux-image-5-4-0-1121-oracle
- ubuntu-upgrade-linux-image-5-4-0-1122-aws
- ubuntu-upgrade-linux-image-5-4-0-1126-gcp
- ubuntu-upgrade-linux-image-5-4-0-1127-azure
- ubuntu-upgrade-linux-image-5-4-0-175-generic
- ubuntu-upgrade-linux-image-5-4-0-175-lowlatency
- ubuntu-upgrade-linux-image-5-4-0-176-generic
- ubuntu-upgrade-linux-image-5-4-0-176-generic-lpae
- ubuntu-upgrade-linux-image-5-4-0-176-lowlatency
- ubuntu-upgrade-linux-image-6-1-0-1035-oem
- ubuntu-upgrade-linux-image-aws
- ubuntu-upgrade-linux-image-aws-lts-20-04
- ubuntu-upgrade-linux-image-aws-lts-22-04
- ubuntu-upgrade-linux-image-azure
- ubuntu-upgrade-linux-image-azure-cvm
- ubuntu-upgrade-linux-image-azure-fde
- ubuntu-upgrade-linux-image-azure-fde-lts-22-04
- ubuntu-upgrade-linux-image-azure-lts-20-04
- ubuntu-upgrade-linux-image-azure-lts-22-04
- ubuntu-upgrade-linux-image-bluefield
- ubuntu-upgrade-linux-image-gcp
- ubuntu-upgrade-linux-image-gcp-lts-20-04
- ubuntu-upgrade-linux-image-gcp-lts-22-04
- ubuntu-upgrade-linux-image-generic
- ubuntu-upgrade-linux-image-generic-64k
- ubuntu-upgrade-linux-image-generic-64k-hwe-20-04
- ubuntu-upgrade-linux-image-generic-hwe-18-04
- ubuntu-upgrade-linux-image-generic-hwe-20-04
- ubuntu-upgrade-linux-image-generic-lpae
- ubuntu-upgrade-linux-image-generic-lpae-hwe-20-04
- ubuntu-upgrade-linux-image-gke
- ubuntu-upgrade-linux-image-gke-5-15
- ubuntu-upgrade-linux-image-gkeop
- ubuntu-upgrade-linux-image-gkeop-5-15
- ubuntu-upgrade-linux-image-gkeop-5-4
- ubuntu-upgrade-linux-image-ibm
- ubuntu-upgrade-linux-image-ibm-lts-20-04
- ubuntu-upgrade-linux-image-intel
- ubuntu-upgrade-linux-image-intel-iotg
- ubuntu-upgrade-linux-image-kvm
- ubuntu-upgrade-linux-image-lowlatency
- ubuntu-upgrade-linux-image-lowlatency-64k
- ubuntu-upgrade-linux-image-lowlatency-64k-hwe-20-04
- ubuntu-upgrade-linux-image-lowlatency-hwe-18-04
- ubuntu-upgrade-linux-image-lowlatency-hwe-20-04
- ubuntu-upgrade-linux-image-nvidia
- ubuntu-upgrade-linux-image-nvidia-lowlatency
- ubuntu-upgrade-linux-image-oem
- ubuntu-upgrade-linux-image-oem-20-04
- ubuntu-upgrade-linux-image-oem-20-04b
- ubuntu-upgrade-linux-image-oem-20-04c
- ubuntu-upgrade-linux-image-oem-20-04d
- ubuntu-upgrade-linux-image-oem-22-04
- ubuntu-upgrade-linux-image-oem-22-04a
- ubuntu-upgrade-linux-image-oem-22-04b
- ubuntu-upgrade-linux-image-oem-22-04c
- ubuntu-upgrade-linux-image-oem-osp1
- ubuntu-upgrade-linux-image-oracle
- ubuntu-upgrade-linux-image-oracle-lts-20-04
- ubuntu-upgrade-linux-image-oracle-lts-22-04
- ubuntu-upgrade-linux-image-raspi
- ubuntu-upgrade-linux-image-raspi-hwe-18-04
- ubuntu-upgrade-linux-image-raspi-nolpae
- ubuntu-upgrade-linux-image-raspi2
- ubuntu-upgrade-linux-image-snapdragon-hwe-18-04
- ubuntu-upgrade-linux-image-virtual
- ubuntu-upgrade-linux-image-virtual-hwe-18-04
- ubuntu-upgrade-linux-image-virtual-hwe-20-04
- ubuntu-upgrade-linux-image-xilinx-zynqmp
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center