Linux distribution Debian launches 12.2 and 11.8 versions to fix "AMD Inception" and other vulnerabilities

Thanks to CTOnews.com netizens, soft media users 1520111, Alejandro86, makeithappen for the delivery of clues! CTOnews.com, Oct. 9, Debian is one of the oldest GNU / Linux distributions and the basis for many other Linux-based operating systems, including Ubuntu, Kali, MX and raspberry pie OS. Recently, Debian has released versions 12.2 and 11.8, mainly fixing a number of security issues.

▲ source Debian official website CTOnews.com collates the relevant content as follows:

Fix the microcode (microcode) vulnerability, that is, the previous fix for "AMD Inception" in AMD Zen4 processors

The vulnerability can lead to a return stack buffer overflow and the target address is controlled by the attacker, allowing the attacker to disclose arbitrary data from unprivileged processes running on any AMD Zen CPU.

Even if CPU has deployed mitigation measures for speculative execution attacks (such as Spectre) or transient control flow hijacking (such as automatic IBRS), there is still the possibility of disclosure.

Fix remote code execution vulnerability [CVE-2023-40477]

After a user opens a specific RAR compressed file, the hacker can execute arbitrary code remotely.

The reason for this vulnerability is that the system lacks sufficient verification of the data provided by the user, which makes the RAM access content exceed the original allocated buffer.

In addition, Debian versions 12.2 and 11.8 fixed compatibility issues with Python 3.11 and crashes when parsing JPEG attachments.

Related reading: "Inception vulnerability exposure: affects all AMD Zen processors and can disclose sensitive data"

Referenc

"Updated Debian 12: 12.2 released"-Debian