Ubuntu USN-9003-1 updates the NVIDIA Linux kernel
Ubuntu USN-9003-1 fixes many flaws in the NVIDIA Linux kernel, including an AMD SEV-SNP issue. See who is affected and how to check your servers.
TL;DR: Ubuntu published USN-9003-1, a kernel update for the NVIDIA kernel flavor that fixes many flaws, including an AMD processor issue. Install the new kernel and reboot.
What happened
Ubuntu Security Notices published USN-9003-1 for the Linux kernel built for NVIDIA systems. The notice lists a long run of flaws in kernel subsystems, among them processor architectures, file systems, drivers and networking. One item stands apart: a memory-protection check in some AMD processors was skipped when the IOMMU touched certain host buffers. It is tracked as CVE-2023-20585, and Ubuntu warns that an attacker already controlling the hypervisor might undermine the integrity of memory that protects SEV-SNP guests.
For the other flaws Ubuntu says only that they might be used to compromise the system. The notice does not give a single score for the group, so rank this update by how exposed the machine is: shared hosts and servers that run untrusted workloads first.
Am I affected?
You are affected if you run the NVIDIA kernel flavor on Ubuntu, which is typical for GPU servers and some embedded boards. Other kernel flavors are covered by their own notices. Check the running kernel with uname -r and the installed packages with apt list --installed 'linux-image*', then compare with the package version in Ubuntu's notice. Updating the package is not enough: the machine runs the old kernel until it is rebooted.
How to check with Stackurity
Stackurity reads installed packages on Ubuntu servers and matches them against Ubuntu's advisories using Ubuntu's own version rules, so a package that already carries the fix is not reported. Each fix shows the version to move to and every issue it clears, and Check again records whether it worked. See how verification works. Stackurity Cloud has a 14-day free trial without a card: start a free trial.
