USN-6549-2: Linux kernel (GKE) vulnerabilities

It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a …

attacker crash cve denial of service device gke handling kernel linux linux kernel local netlink out-of-bounds race race condition service subsystem system transformation usb usn vulnerabilities vulnerability