USN-7003-5: Linux kernel vulnerabilities

Releases

• Ubuntu 18.04 ESM

Packages

• linux-raspi-5.4 - Linux kernel for Raspberry Pi systems

Details

It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Media drivers;
• VMware VMCI Driver;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• SCSI drivers;
• USB subsystem;
• JFFS2 file system;
• JFS file system;
• File systems infrastructure;
• NILFS2 file system;
• IOMMU subsystem;
• Sun RPC protocol;
• Netfilter;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• IUCV driver;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SoC Audio for Freescale CPUs drivers;
  (CVE-2024-40916, CVE-2024-41035, CVE-2024-39469, CVE-2024-39499,
  CVE-2024-36978, CVE-2024-42092, CVE-2024-42087, CVE-2024-42102,
  CVE-2024-40978, CVE-2024-40902, CVE-2024-36974, CVE-2024-42096,
  CVE-2024-40974, CVE-2024-40904, CVE-2024-40905, CVE-2024-42153,
  CVE-2024-42106, CVE-2024-42070, CVE-2024-41097, CVE-2024-42090,
  CVE-2024-42105, CVE-2024-42104, CVE-2024-39502, CVE-2024-41089,
  CVE-2024-40945, CVE-2024-38619, CVE-2024-40961, CVE-2024-42127,
  CVE-2024-39487, CVE-2024-40988, CVE-2024-41044, CVE-2024-42236,
  CVE-2024-40942, CVE-2024-39506, CVE-2024-39509, CVE-2024-39503,
  CVE-2024-40934, CVE-2024-40959, CVE-2024-42101, CVE-2024-40960,
  CVE-2024-40968, CVE-2024-41087, CVE-2023-52803, CVE-2024-40987,
  CVE-2024-40943, CVE-2024-42089, CVE-2023-52887, CVE-2024-37078,
  CVE-2024-42148, CVE-2024-36894, CVE-2024-42097, CVE-2024-41006,
  CVE-2024-40984, CVE-2024-40963, CVE-2024-42223, CVE-2024-40912,
  CVE-2024-42086, CVE-2024-41049, CVE-2024-42157, CVE-2024-41034,
  CVE-2024-42145, CVE-2024-42124, CVE-2024-40995, CVE-2024-42224,
  CVE-2024-40981, CVE-2024-41095, CVE-2024-40901, CVE-2024-42115,
  CVE-2024-41041, CVE-2024-41007, CVE-2024-39505, CVE-2024-40932,
  CVE-2024-39495, CVE-2024-40980, CVE-2024-42084, CVE-2024-41046,
  CVE-2024-42119, CVE-2024-42076, CVE-2024-42232, CVE-2024-39501,
  CVE-2024-40958, CVE-2024-40941, CVE-2024-42093, CVE-2024-42094,
  CVE-2024-42154)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• linux-image-5.4.0-1116-raspi - 5.4.0-1116.128~18.04.1
  Available with Ubuntu Pro
• linux-image-raspi-hwe-18.04 - 5.4.0.1116.128~18.04.1
  Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

• CVE-2024-42232
• CVE-2024-40984
• CVE-2024-40912
• CVE-2024-41049
• CVE-2024-41035
• CVE-2024-41089
• CVE-2024-42096
• CVE-2024-39505
• CVE-2024-42084
• CVE-2024-40943
• CVE-2024-40980
• CVE-2024-42105
• CVE-2024-40978
• CVE-2024-42224
• CVE-2024-40901
• CVE-2024-40963
• CVE-2024-40961
• CVE-2024-42124
• CVE-2024-42101
• CVE-2024-41097
• CVE-2024-42089
• CVE-2024-41087
• CVE-2024-42157
• CVE-2024-40988
• CVE-2024-41041
• CVE-2024-41006
• CVE-2024-39495
• CVE-2024-36978
• CVE-2024-40942
• CVE-2024-41007
• CVE-2024-40904
• CVE-2024-39469
• CVE-2024-40916
• CVE-2024-42104
• CVE-2024-42115
• CVE-2024-42087
• CVE-2024-42102
• CVE-2024-42153
• CVE-2024-42145
• CVE-2024-42092
• CVE-2024-42086
• CVE-2024-39503
• CVE-2023-52803
• CVE-2024-40932
• CVE-2024-42148
• CVE-2024-39509
• CVE-2024-42119
• CVE-2024-42093
• CVE-2024-40974
• CVE-2024-42094
• CVE-2024-40995
• CVE-2024-40945
• CVE-2024-40959
• CVE-2024-42154
• CVE-2024-41046
• CVE-2024-39506
• CVE-2024-38619
• CVE-2024-40905
• CVE-2024-39502
• CVE-2024-40981
• CVE-2024-39501
• CVE-2024-40941
• CVE-2024-36894
• CVE-2024-42097
• CVE-2024-41095
• CVE-2024-36974
• CVE-2024-42127
• CVE-2024-40934
• CVE-2023-52887
• CVE-2024-40987
• CVE-2024-41044
• CVE-2024-40902
• CVE-2024-37078
• CVE-2024-42090
• CVE-2024-42106
• CVE-2024-40958
• CVE-2024-42070
• CVE-2024-40960
• CVE-2024-39499
• CVE-2024-41034
• CVE-2024-42223
• CVE-2024-42076
• CVE-2024-39487
• CVE-2024-40968
• CVE-2024-42236

Related notices

• USN-7003-1
• USN-7003-2
• USN-7006-1
• USN-7003-3
• USN-7007-1
• USN-7009-1
• USN-7019-1
• USN-7007-2
• USN-7007-3
• USN-7009-2
• USN-7003-4
• USN-7089-2
• USN-7089-1
• USN-7090-1
• USN-7089-3
• USN-7095-1
• USN-7089-4
• USN-7089-5
• USN-7089-6
• USN-7089-7
• USN-7156-1
• USN-6999-1
• USN-7004-1
• USN-7005-1
• USN-7005-2
• USN-7008-1
• USN-6999-2
• USN-7029-1
• USN-7121-1
• USN-7121-2
• USN-7121-3
• USN-7148-1
• USN-7020-1
• USN-7020-2
• USN-7028-1
• USN-7020-3
• USN-7020-4
• USN-7028-2
• USN-7069-1
• USN-7069-2
• USN-7110-1
• USN-7039-1
• USN-6949-1
• USN-6952-1
• USN-6955-1
• USN-6949-2