Canonical Ubuntu Linux 22.10

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.

Openssh: regresshion - race condition in ssh allows rce/dos

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

local privilege escalation in apport-cli

Race condition in snap-confine's must_mkdir_and_open_with_perms()

io_uring UAF, Unix SCM garbage collection

The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.

sensitive data exposure in cloud-init logs

shiftfs lock unbalance in Ubuntu-specific kernels