Ubuntu releases security updates for NVIDIA Tegra kernel and multiple subsystems

Ubuntu has issued security notice USN-9091-1, providing critical updates for the linux-nvidia-tegra package used in NVIDIA Tegra systems on Ubuntu 24.04 LTS. The update addresses a significant vulnerability (CVE-2023-20585) where certain AMD processors failed to perform proper Reverse Map Table (RMP) checks during IOMMU access to host buffers.

Beyond the AMD-specific flaw, the release patches a vast array of security issues across nearly every major Linux kernel subsystem. These fixes impact diverse architectures including x86, ARM64, RISC-V, and MIPS, covering everything from memory management and networking to specialized drivers for Intel NPUs and various file systems.

Technical breakdown of kernel vulnerabilities

• AMD SEV-SNP Integrity: CVE-2023-20585 addresses a flaw where improper RMP checks by the IOMMU could allow a local attacker with hypervisor access to trigger out-of-bounds conditions, potentially compromising SEV-SNP guest memory integrity.
• Broad Architecture Support: The security patches extend to multiple instruction set architectures, including ARM32, ARM64, M68K, MIPS, PowerPC, RISC-V, S390, and x86.
• Subsystem Coverage: Fixes are distributed across critical layers including the Block layer, Memory management, Cryptographic API, IOMMU subsystem, and the Networking core.
• Hardware-Specific Drivers: The update includes security corrections for specialized hardware drivers such as Intel NPU, Intel Stratix 10 firmware, Microsoft Hyper-V, and various Qualcomm and Google firmware drivers.

Why it matters

This update is vital for users of NVIDIA Tegra-based hardware and cloud environments utilizing AMD SEV-SNP for confidential computing. The extensive nature of the subsystem fixes means system administrators must prioritize these updates to secure diverse deployments ranging from embedded ARM devices to high-performance x86 servers.