CVE-2024-35849
High · 7.1CVSS
7.1
EPSS
0.3%
Published
May 17, 2024
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel's BTRFS file-system code could let a logged-in user read fragments of the system's internal memory that should have stayed hidden.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Local unprivileged process can trigger btrfs_ioctl_logical_to_ino() which allocates a btrfs_data_container via kvmalloc() without zeroing, then copies the entire structure (including 40-65535 bytes of uninitialized kernel memory) back to user space via copy_to_user.
Why it matters to the business
Local users on affected Linux systems may obtain fragments of kernel memory, increasing the chance of further privilege escalation or credential theft on shared or multi-tenant hosts.
How an attack unfolds
An attacker with local shell access invokes the BTRFS_IOC_LOGICAL_TO_INO ioctl; the kernel path in init_data_container() and btrfs_ioctl_logical_to_ino() returns a large buffer containing leftover slab or stack contents that the attacker can inspect for pointers, keys or other sensitive data.
How to fix it
Upgrade the Linux kernel to a version containing commit 689efe22e9b5b7d9d523119a9a5c3c17107a0772 (or later stable backport) which replaces kvmalloc() with kvzalloc() in init_data_container(). Reboot after installing the updated kernel package.
How to confirm the fix worked
Confirm the running kernel contains commit 689efe22e9b5b7d9d523119a9a5c3c17107a0772 or verify the btrfs ioctl path uses kvzalloc(); run the original syzbot reproducer and check that the returned buffer no longer contains uninitialized bytes beyond the structure header.
Typical attack path
- Obtain local shell on an affected Linux system
- Open a BTRFS file-system descriptor
- Craft and issue BTRFS_IOC_LOGICAL_TO_INO ioctl with controlled logical address
- Receive 64 KiB buffer containing uninitialized kernel memory
- Parse leaked bytes for useful artifacts to aid further exploitation
How to detect it
Kernel information leaks of this type leave no persistent artifacts; review auditd or syscall logs for repeated BTRFS_IOC_LOGICAL_TO_INO calls from untrusted UIDs and inspect any user-space processes that subsequently access large amounts of /proc/kallsyms or /dev/mem.
What your security team should do
- Prioritize kernel updates on all BTRFS systems within the next patching cycle
- Restrict unprivileged ioctl access via seccomp or LSM policies where feasible
- Monitor for new stable kernel releases that include the referenced commit
The record
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000 This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory. Fix this by using kvzalloc() which zeroes out the memory on allocation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | linux | 0 | 4.19.316-1 |
| Debian:10 | linux-5.10 | 0 | 5.10.216-1~deb10u1 |
| Debian:11 | linux | 0 | 5.10.216-1 |
| Debian:12 | linux | 0 | 6.1.90-1 |
| Debian:13 | linux | 0 | 6.8.9-1 |
| Linux | Kernel | 0 | 4.19.313 |
| Linux | Kernel | 3.2.0 | 4.19.313 |
| Mageia:9 | dwarves | 0 | 1.27-1.mga9 |
| Mageia:9 | kernel | 0 | 6.6.37-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.37-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.0.18-50.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-59.mga9 |
| SUSE:Linux Enterprise High Availability Extension 12 SP5 | kernel-default | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_57 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5-RT_Update_16 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_15 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_1 | 0 | 1-150600.1.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_1 | 0 | 1-150600.13.3.7 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.68.1.150500.6.31.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-64kb | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.68.1.150500.6.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-zfcpdump | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.7.3.150600.12.2.7 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.7.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.7.4 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.7.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.7.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-azure | 0 | 5.14.21-150500.33.57.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-source-azure | 0 | 5.14.21-150500.33.57.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-syms-azure | 0 | 5.14.21-150500.33.57.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.5.4 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.5.4 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.5.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-rt | 0 | 4.12.14-10.188.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-rt_debug | 0 | 4.12.14-10.188.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-source-rt | 0 | 4.12.14-10.188.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-syms-rt | 0 | 4.12.14-10.188.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-azure | 0 | 4.12.14-16.188.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-default | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-source | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-source-azure | 0 | 4.12.14-16.188.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-syms | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-syms-azure | 0 | 4.12.14-16.188.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-azure | 0 | 4.12.14-16.188.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-default | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-source | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-source-azure | 0 | 4.12.14-16.188.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-syms | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-syms-azure | 0 | 4.12.14-16.188.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | kernel-docs | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | kernel-obs-build | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP5 | kernel-default | 0 | 4.12.14-122.219.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.7.3 |
| SUSE:Real Time Module 15 SP5 | kernel-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt_debug | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP5 | kernel-source-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP5 | kernel-syms-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.5.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.5.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.5.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.5.1 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:20.04:LTS | linux | 0 | 5.4.0-189.209 |
| Ubuntu:20.04:LTS | linux-aws | 0 | 5.4.0-1128.138 |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1065.71~20.04.1 |
| Ubuntu:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | 5.4.0-1133.140 |
| Ubuntu:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1068.77~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde-5.15 | 0 | 5.15.0-1068.77~20.04.1.1 |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | 5.4.0-1088.95 |
| Ubuntu:20.04:LTS | linux-gcp | 0 | 5.4.0-1132.141 |
| Ubuntu:20.04:LTS | linux-gcp-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1065.73~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop | 0 | 5.4.0-1095.99 |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 0 | 5.15.0-1048.55~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-116.126~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | 5.4.0-1075.80 |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1058.61~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1060.66~20.04.1 |
| Ubuntu:20.04:LTS | linux-iot | 0 | 5.4.0-1040.41 |
| Ubuntu:20.04:LTS | linux-kvm | 0 | 5.4.0-1116.123 |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-116.126~20.04.1 |
| Ubuntu:20.04:LTS | linux-nvidia-tegra-5.15 | 0 | 5.15.0-1027.27~20.04.1 |
| Ubuntu:20.04:LTS | linux-oem-5.10 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.14 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.6 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | 5.4.0-1127.136 |
| Ubuntu:20.04:LTS | linux-oracle-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1063.69~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | 5.4.0-1112.124 |
| Ubuntu:20.04:LTS | linux-raspi2 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | 5.15.0-1061.65~20.04.1 |
| Ubuntu:20.04:LTS | linux-riscv-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | 5.4.0-1047.51 |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-116.126 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1065.71 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | 6.8.0-1013.14~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1068.77 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | 6.8.0-1012.14~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 0 | 5.15.0-1068.77.1 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1064.72 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | 6.8.0-1012.13~22.04.1 |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1062.68 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1048.55 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | 6.8.0-40.40~22.04.3 |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1058.61 |
| Ubuntu:22.04:LTS | linux-ibm-6.8 | 0 | 6.8.0-1010.10~22.04.1 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1060.66 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1062.67 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-116.126 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | 6.8.0-40.40.1~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | 5.15.0-1060.61 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | 6.8.0-1011.11~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 0 | 5.15.0-1026.26 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 0 | 5.15.0-1015.15 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle | 0 | 5.15.0-1063.69 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | 6.8.0-1010.10~22.04.1 |
| Ubuntu:22.04:LTS | linux-raspi | 0 | 5.15.0-1058.61 |
| Ubuntu:22.04:LTS | linux-realtime | 0 | No fix |
Related vulnerabilities
- CVE-2023-52340 The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size… Also affects linux
- CVE-2024-39292 In the Linux kernel, the following vulnerability has been resolved: um: Add winch to… Also affects linux
- CVE-2024-38780 In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync… Also affects linux
- CVE-2024-36288 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop… Also affects linux
- CVE-2024-38633 In the Linux kernel, the following vulnerability has been resolved: serial: max3100… Also affects linux
- CVE-2024-38634 In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock… Also affects linux
- CVE-2024-38637 In the Linux kernel, the following vulnerability has been resolved: greybus: lights… Also affects linux
- CVE-2024-38659 In the Linux kernel, the following vulnerability has been resolved: enic: Validate length… Also affects linux