ClickCease Linux Kernel KVM Vulnerabilities Fixed in Ubuntu 18.04

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

Linux Kernel KVM Vulnerabilities Fixed in Ubuntu 18.04

by Rohan Timalsina

October 16, 2023 - TuxCare expert team

Ubuntu security updates for Ubuntu 18.04 have addressed multiple Linux kernel KVM vulnerabilities. In this blog, we will discuss KVM and its discovered vulnerabilities, as well as how to mitigate them to avoid security risks.

KVM, or Kernel-based Virtual Machine, is built into the Linux kernel. Your Linux operating system can be converted into a hypervisor using KVM, allowing it to manage many virtual machines (VMs) running various guest operating systems on a single physical host.

In the Linux community, KVM has grown in popularity as a virtualization option because it offers a dependable and effective way to operate numerous virtual machines (VMs) on a single host. It is frequently used for various testing and development purposes, as well as in data centers and cloud environments.

 

Linux Kernel KVM Vulnerabilities

CVE-2022-27672

CVSS 3.x Score: 4.7 Medium

It was found that certain SMT-enabled AMD processors could speculatively execute instructions using a return address from a sibling thread. A local attacker can use this to disclose sensitive information.

 

CVE-2022-40982

CVSS 3.x Score: 6.5 Medium

After the speculative execution of several instructions, some Intel(R) Processors did not properly clear the microarchitectural state. A local, non-privileged user might utilize this to steal sensitive data.

Learn more about this flaw in detail here.

 

CVE-2023-3212

CVSS 3.x Score: Medium

Yang Lan identified a vulnerability within the Linux kernel’s GFS2 file system implementation, which, under certain conditions, could lead to an attempt to dereference a null pointer. An attacker could exploit this issue to craft a malicious GFS2 image that, when mounted and manipulated, can trigger a denial of service, ultimately resulting in a system crash.

 

CVE-2023-3863

CVSS 3.x Score: 4.1 Medium

The NFC implementation in the Linux kernel was identified with a use-after-free flaw when handling peer-to-peer communication in some conditions. A privileged local user can use this flaw to cause denial of service or kernel memory leak issues.

 

CVE-2023-40283

CVSS 3.x Score: 7.8 High

The Linux kernel’s bluetooth subsystem did not handle the L2CAP socket release properly, resulting in a use-after-free flaw. A local attacker can use this flaw to cause DoS attacks or execute arbitrary code.

 

CVE-2023-4128

CVSS 3.x Score: 7.8 High

A user-after-free vulnerability was found in the Linux kernel’s network classifier implementations that a local attacker can exploit to cause a denial of service or escalate their privileges.

 

Final Thoughts

To address the above KVM vulnerabilities, it is essential to update the linux-kvm package, a Linux kernel for cloud environments. Since Ubuntu 18.04 has already reached end of life, the security updates are only available to Ubuntu Pro users. Alternatively, you might want to consider TuxCare’s Extended Lifecycle Support for Ubuntu 18.04, which is more affordable and provides automated security patching for up to 5 years.

Speak to a TuxCare Linux security expert to get started with extended support.

 

The sources for this article include a story from Ubuntu Security Notices.

Summary
Linux Kernel KVM Vulnerabilities Fixed in Ubuntu 18.04
Article Name
Linux Kernel KVM Vulnerabilities Fixed in Ubuntu 18.04
Description
Explore the details on KVM vulnerabilities patched in the Linux kernel for Ubuntu 18.04. Upgrade now to safeguard your system.
Author
Publisher Name
TuxCare
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Become a TuxCare Guest Writer

Mail

Join

4,500

Linux & Open Source
Professionals!

Subscribe to
our newsletter