CVE-2022-25258 and CVE-2022-25375

[Luís Infante da Câmara]

These packages are vulnerable to CVE-2022-25258 and CVE-2022-25375 in at least one Ubuntu release, as stated in the Ubuntu CVE Tracker.

Please release fixed packages.

Debian released an advisory on March 7.

[Marc Deslauriers (mdeslaur)]

The security team doesn't track security updates using launchpad bugs. The CVE tracker is where security updates are tracked:

https://ubuntu.com/security/cves

You can follow the progress on those CVEs here:

https://ubuntu.com/security/cve-2022-25258
https://ubuntu.com/security/cve-2022-25375

[Luís Infante da Câmara (luis220413)]

I filed this bug to alert that these vulnerabilities were unpatched for 2 months. Some kernels in supported Ubuntu releases are still affected:

$ wget https://git.launchpad.net/ubuntu-cve-tracker/plain/active/CVE-2022-25258
$ grep -vE '^(upstream_[a-z0-9.-]+: |Patches_[a-z0-9.-]+:$| break-fix:|([a-z]+|trusty/esm|esm-infra/xenial)_[a-z0-9.-]+: (DNE$|released |not-affected($| )|ignored)|$)' CVE-2022-25258

bionic_linux-aws-5.4: pending (5.4.0-1073.78~18.04.1)
focal_linux-bluefield: needed
fips/xenial_linux-fips: needs-triage
fips-updates/xenial_linux-fips: needs-triage
fips/bionic_linux-fips: needs-triage
fips-updates/bionic_linux-fips: needs-triage
fips/focal_linux-fips: needs-triage
fips-updates/focal_linux-fips: needs-triage
bionic_linux-gke-5.4: pending (5.4.0-1069.72~18.04.1)
bionic_linux-raspi2: pending (4.15.0-1109.116)
impish_linux-riscv: pending (5.13.0-1021.23)
focal_linux-oracle-5.13: pending (5.13.0-1028.33~20.04.1)

Please release patched versions of linux-bluefield and linux-fips.

[Luís Infante da Câmara (luis220413)]

Fixed in linux-bluefield 5.4.0-1040.44.