Canonical has recently patched a number of security flaws in Graphviz as well as the Linux kernel that powers Ubuntu.

Null pointer dereference vulnerabilities in Graphviz and inappropriate handling of indirect branch prediction isolation between L1 and L2 VMs in the KVM VMX version of the Linux kernel are two recent examples of security flaws that have been discovered.

Listed below are all of the impacted packages, which you can find here:

graphviz is a comprehensive collection of tools for creating graphs.
linux — Linux kernel
linux-oem-6.0 — Linux kernel for OEM systems
Linux kernel support for Amazon Web Services (AWS) infrastructure is provided via the linux-aws project.
linux-azure — Linux kernel for Microsoft Azure Cloud systems
linux-gcp — Linux kernel for Google Cloud Platform (GCP) systems
linux-ibm — Linux kernel for IBM cloud systems
linux-kvm — Linux kernel for cloud environments
linux-lowlatency is a Linux kernel with a low latency.
linux-oracle — Linux kernel for Oracle Cloud systems
linux-raspi — Linux kernel for Raspberry Pi systems

It is possible to abuse Graphviz by using an input file that has been specifically constructed for this purpose, which might lead to issues such as denial of service.

The only versions that are impacted by this vulnerability are Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and 14.04 ESM. A null pointer dereference vulnerability was found to exist in the graphviz program, which led to the discovery of the vulnerability.

In addition, a buffer overflow vulnerability that might result in the execution of arbitrary code has been found in graphviz.

In addition to this, the following errors are associated with the use of graphviz and are detailed below:

CVE-2018-10196
CVE-2019-11023
CVE-2020-18032

According to the Ubuntu report, there is a possibility that sensitive data from the host operating system or other guest virtual machines might be exposed if indirect branch prediction isolation between L1 and L2 virtual machines is handled in an incorrect manner.

It was recently revealed that the Xen network backend driver in the Linux kernel, under certain conditions, displayed a race situation while dealing with lost packets and was unable to handle them in an appropriate manner. This was discovered by accident.

By taking advantage of this vulnerability, a hacker would be able to execute arbitrary code, bring about a crash in the system, and maybe induce a kernel deadlock.

Gerald Lee was the one who identified the use-after-free vulnerability that is present in the Linux kernel’s implementation of the USB Gadget file system. This vulnerability may result in use-after-free vulnerabilities in certain scenarios.

Security researchers José Oliveira and Rodrigo Branco found that the Linux kernel’s implementation of the prctl syscall did not provide enough protection against some indirect branch prediction attacks.

As a consequence of this, sensitive information may be revealed if a local attacker employs this strategy.

Both the ALSA (Advanced Linux Sound Architecture) subsystem and the io uring subsystem of the Linux kernel are vulnerable to a use-after-free attack due to a single flaw. In addition to this, the issue is also present in the Common Internet File System (CIFS), which is a network file system.

The RNDIS USB driver in the Linux kernel has a security flaw called an integer overflow vulnerability. An adversary who has physical access to the system might possibly compromise it by inserting a USB device that contains malicious code. This could result in a denial of service or the execution of arbitrary code.

In addition to this, we have included below the vulnerabilities that were present in the Linux kernel, which are as follows:

CVE-2022-4382
CVE-2022-42328
CVE-2022-2196
CVE-2023-0469
CVE-2023-0045
CVE-2023-0266
CVE-2023-23559
CVE-2022-42329
CVE-2023-1195

It is necessary for you to upgrade your system to the versions of the packages listed below in order to resolve this issue.
In addition, Canonical said that users are need to restart their computers after the installation of a regular system update in order for all of the required modifications to take effect.