Hello! This is my first submission and as such I would like to report a vulnerability: CVE-2023-3269, named "Stack Rot".
This is a flaw in the handling of stack expansion. I won't go into too many details, as I am a linux sysadmin, not a programmer and I will leave sources below from the discoverer of this vulnerability and the git merge message that Linus Torvalds published. An unprivileged local user could use this flaw to compromise the kernel and escalate their privileges. On June 28th, during the merge window for Linux kernel 6.5, the fix was merged into Linus' tree. The patches were also backported to stable kernel (6.1.37, 6.3.11 and 6.4.1), so the bug was resolved since July 1st. However, in my testing of Mantic Minotaur, the daily build from 24072023, I have noticed that the kernel it was using was version 6.3.0-7. And I haven't seen any submissions regarding this on lists.ubuntu.com, so I decided to post it here to. hopefully, apply the patch to the kernel. Here are the sources: The discoverer of this vulnerability, Ruihan Li: https://github.com/lrh2000/StackRot The merge message: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9471f1f2f50282b9e8f59198ec6bb738b4ccc009 Regards, Andrei Datcu (datcuandrei.xyz) -- Ubuntu-quality mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-quality
