Ubuntu alert USN-8853-1 (opensbi)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8853-1] OpenSBI vulnerability
Date:
             
 
Wed, 30 Sep 2026 13:31:47 +0000
Message-ID:
             
 
<E1xBuPU-0005fJ-03@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8853-1
September 30, 2026

opensbi vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS

Summary:

OpenSBI could be made to crash if it received specially crafted
input.

Software Description:
- opensbi: RISC-V Open Source Supervisor Binary Interface

Details:

It was discovered that OpenSBI did not properly validate the counter index
mask in SBI PMU extension requests. An attacker could use this issue to
cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  opensbi                         1.3-1ubuntu0.22.04.3

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8853-1
  CVE-2025-63913

Package Information:
  https://launchpad.net/ubuntu/+source/opensbi/1.3-1ubuntu0...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq9DtkACgkQcpJm3tlz
hgG7zhAAocslbrT4SlbKCoTqAYQp3ulVzSLXsev5+TjWKTzi/IRDnsqm2rctzXeK
DAfnIcSFoXbXBUIjSBLXcG12SvZ3+pdBNJPf6p3H8sMef7gYZ1yGG33d1oqJO6lM
8cu4ztu4P6n2Llfs4ZDp3gccE9xQvZ2VVZ1c7NyTNacaeEQV3hg819NDc0cAUZZJ
2c3O1WGqaEtL30Cd/SxbgvCVTeVQpy97B83at//+K/+DKNjuHFweM1c8gJ/0tgbA
NEcv55WNAGotCuMyfhr+QYpJxVi9vjk+XVoWkNTUGnXEFabDFndv8hNbOcKOzjTz
xvsSnPuXEV/G2r76xgTvcDAkcBr7gITgXgKeeugYrOOANAgIV60d0u6e9oM5lw3R
pyByCc/72Y8pbaaaV7TYLxmQcc8Y3CUCHlmZqDaoRcvD7elu5SEA2F+jCZ/roL7t
B9Gt2P2AwCTRl7Jl0ClpeK6q3wV33DOeCcTa4ukf3of6uNJ3yIxfXdIFAcfhpsdV
TlhoM0IclsxY+jTcQZWLesYfTQGUEtf79W2Wj4iLrqyWED5FNgsIbu4j0UwWPmOK
h6Okt+LQOKBvk/ky+/cgy6+eAAoTID4NcAUl1uI8cSUlYv6PaTMZi6YqucUeIvcC
bnQ86Va3eqQv7B1fPxEJvE+N3eYtTosucobbcmuDo+MhEsX5Oic=
=fqGz
-----END PGP SIGNATURE-----