USN-8802-1: Linux kernel (Oracle) vulnerabilities

In plain language

What this advisory means

Security vulnerabilities were found in the Linux kernel used by Oracle Cloud systems, affecting many components like network drivers, file systems, and Bluetooth. Attackers might exploit these flaws to compromise the system. An update has been provided to correct these issues, and users need to apply this update and then reboot to secure their systems.

Technical explanation

How the issue affects the environment

Multiple security issues exist in the Linux kernel version for Oracle Cloud, impacting subsystems such as ARM architectures, drivers (network, GPU, Bluetooth, Azure Network Adapter), various file systems, network protocols (IPv4, IPv6, TLS), memory management, tracing, and security modules. These vulnerabilities could be exploited by attackers to gain unauthorized privileges or cause system compromise. The kernel update 6.8.0-1061.64 for Ubuntu 22.04 LTS and 24.04 LTS addresses these flaws, requiring a system reboot and recompilation of third-party kernel modules due to ABI changes.

Operational impact

Why teams should care

Organizations running Oracle Cloud Linux kernel on Ubuntu are at risk of system compromise, potentially leading to data breaches or service disruption. Without timely updates, systems remain vulnerable to attacks exploiting these kernel issues, threatening confidentiality, integrity, and availability of services.

Affected and fixed releases

Temporary risk reduction

The official notice does not specify a workaround. Applying the update and rebooting is required.

Evidence and validation checklist

• Ubuntu Security Notice USN-8802-1 confirms multiple security flaws in Linux kernel components.
• List of vulnerable subsystems including network, Bluetooth, file systems, and kernel frameworks.
• Official patched kernel version 6.8.0-1061.64 released for Ubuntu 22.04 LTS and 24.04 LTS.
• Require reboot and recompilation of kernel modules noted due to ABI changes.