DSA-5453-1 linux -- security update

Debian Security Advisory

DSA-5453-1 linux -- security update

Date Reported:

16 Jul 2023

Affected Packages:

linux

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2023-2156, CVE-2023-31248, CVE-2023-35001.

More information:

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

• CVE-2023-2156

  It was discovered that a flaw in the handling of the RPL protocol may allow an unauthenticated remote attacker to cause a denial of service if RPL is enabled (not by default in Debian).

• CVE-2023-31248

  Mingi Cho discovered a use-after-free flaw in the Netfilter nf_tables implementation when using nft_chain_lookup_byid, which may result in local privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.

• CVE-2023-35001

  Tanguy DUBROCA discovered an out-of-bounds reads and write flaw in the Netfilter nf_tables implementation when processing an nft_byteorder expression, which may result in local privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.

For the oldstable distribution (bullseye), these problems have been fixed in version 5.10.179-2.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux