Ubuntu releases security updates for Linux kernel vulnerabilities (USN-8887-3)

Ubuntu has issued security notices addressing multiple vulnerabilities within the Linux kernel. A notable issue (CVE-2023-20585) involves AMD processors failing to perform proper Reverse Map Table (RMP) checks during IOMMU access, potentially allowing local attackers with hypervisor access to compromise SEV-SNP guest memory. The update covers a vast range of subsystems including architectures, file systems, and various device drivers.

Vulnerability details and scope

• CVE-2023-20585: Affects AMD processors where improper RMP checks during IOMMU access can lead to out-of-bounds conditions, impacting SEV-SNP memory integrity.
• Architectural fixes: Updates provided for ARM64, ARM32, MIPS, OpenRISC, PowerPC, RISC-V, and S390.
• Subsystem coverage: Fixes include the BPF subsystem, IOMMU, Cryptographic API, and various storage drivers (NVMe, SCSI, BTRFS, Ext4, etc.).
• Driver updates: Extensive patches for networking, USB, Bluetooth, GPU, and virtualization drivers (Virtio, Xen, Hyper-V).

Why it matters

The wide range of affected subsystems means users across diverse hardware platforms, from RISC-V to x86, should apply these kernel updates to maintain system integrity.