USN-8888-1: Linux kernel (Azure) vulnerabilities

In plain language

What this advisory means

Multiple security vulnerabilities were discovered in the Linux kernel used in Microsoft Azure environments, including a notable flaw in AMD processors related to memory access checks. A local attacker with hypervisor access might exploit these issues to compromise system security or the integrity of guest memory protected by SEV-SNP. Ubuntu has released updates to address these vulnerabilities across many subsystems and architectures used in the Linux kernel for Azure.

Technical explanation

How the issue affects the environment

A critical issue was found in certain AMD processors where Reverse Map Table (RMP) checks performed by the Input-Output Memory Management Unit (IOMMU) when accessing host buffers were improperly implemented. This flaw (CVE-2023-20585) could allow a local attacker possessing hypervisor-level access to trigger out-of-bounds memory access, potentially compromising the integrity of SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) guest memory. Additionally, numerous other security vulnerabilities affecting various architectures and kernel subsystems—including ARM64, x86, MIPS, cryptographic APIs, device drivers, filesystems, and networking components—were discovered that could be leveraged by attackers to compromise system integrity and security. Updates addressing these issues have been released for the Linux kernel images used in Microsoft Azure cloud systems on Ubuntu 26.04 LTS.

Operational impact

Why teams should care

Organizations running Ubuntu Linux kernels on Microsoft Azure who do not apply these updates risk exposure to vulnerabilities that may allow attackers with hypervisor access to compromise guest memory integrity or gain unauthorized control of the system. This could lead to data breaches, service disruptions, or loss of sensitive information in virtualized cloud environments. Timely updates and system reboots are necessary to minimize risk and maintain trusted system states.

Affected and fixed releases

Temporary risk reduction

The advisory does not specify any temporary workarounds aside from updating and rebooting the system.

Evidence and validation checklist

• Issue discovered with AMD processor RMP checks during IOMMU host buffer access (CVE-2023-20585).
• Local attacker with hypervisor access could trigger out-of-bounds condition and compromise SEV-SNP guest memory integrity.
• Multiple other Linux kernel security issues identified affecting numerous kernel subsystems and architectures.
• Updates released for Ubuntu 26.04 LTS Linux kernel packages on Microsoft Azure to mitigate vulnerabilities.
• ABI change requires recompilation of third-party kernel modules after update.
• Users advised to reboot systems post-update to fully apply fixes.