Debian Security Advisory
DSA-5453-1 linux -- security update
- Date Reported:
- 16 Jul 2023
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2023-2156, CVE-2023-31248, CVE-2023-35001.
- More information:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
It was discovered that a flaw in the handling of the RPL protocol may allow an unauthenticated remote attacker to cause a denial of service if RPL is enabled (not by default in Debian).
Mingi Cho discovered a use-after-free flaw in the Netfilter nf_tables implementation when using nft_chain_lookup_byid, which may result in local privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.
Tanguy DUBROCA discovered an out-of-bounds reads and write flaw in the Netfilter nf_tables implementation when processing an nft_byteorder expression, which may result in local privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.
For the oldstable distribution (bullseye), these problems have been fixed in version 5.10.179-2.
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux