ALSA-2022:7683 — Moderate: kernel security, bug fix, and enhancement update

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
* race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
* use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
* memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
* smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
* NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
* swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
* uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
* race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
* use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
* use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
* NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
* buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
* nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
* openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
* use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
* net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
* possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
* Spectre-BHB (CVE-2022-23960)
* Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
* memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
* double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
* use after free in SUNRPC subsystem (CVE-2022-28893)
* use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
* DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
* nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 25

Release	Package	Fixed in
AlmaLinux · 8	bpftool	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-abi-stablelists	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-core	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-cross-headers	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-debug	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-debug-core	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-debug-devel	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-debug-modules	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-debug-modules-extra	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-devel	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-doc	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-headers	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-modules	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-modules-extra	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-tools	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-tools-libs	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-tools-libs-devel	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-zfcpdump	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-zfcpdump-core	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-zfcpdump-devel	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-zfcpdump-modules	4.18.0-425.3.1.el8
AlmaLinux · 8	kernel-zfcpdump-modules-extra	4.18.0-425.3.1.el8
AlmaLinux · 8	perf	4.18.0-425.3.1.el8
AlmaLinux · 8	python3-perf	4.18.0-425.3.1.el8

Vulnerabilities 26

Medium 5.3

CVE-2022-2586 Exploited Public exploit EPSS 10%

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…

The Linux Kernel Organization linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Jan 8, 2024
KEV Jun 26, 2024
High 8.6

CVE-2022-1055

Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Mar 29, 2022
High 7.8

CVE-2022-29581 Public exploit

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

May 17, 2022
High 7.5

CVE-2022-36946 Public exploit

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jul 27, 2022
Medium 6.7

CVE-2022-21499

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…

Oracle Oracle Linux Oracle VM linux-raspi2 Linux Debian Ubuntu

Jun 9, 2022
Medium 5.5

CVE-2022-26373

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 18, 2022
Unscored —

CVE-2020-36516

An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 26, 2022
Unscored —

CVE-2020-36558

A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and gen…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 21, 2022
Unscored —

CVE-2021-30002

An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 2, 2021
Unscored —

CVE-2021-3640

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 3, 2022
Unscored —

CVE-2022-0168

A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 26, 2022
Unscored —

CVE-2022-0617

A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers ud…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Feb 16, 2022
Unscored —

CVE-2022-0854

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw al…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 23, 2022
Unscored —

CVE-2022-1016

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 29, 2022
Unscored —

CVE-2022-1048

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PC…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 29, 2022
Unscored —

CVE-2022-1184

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 29, 2022
Unscored —

CVE-2022-1852

A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in th…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jun 30, 2022
Unscored —

CVE-2022-20368

Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Aug 11, 2022
Unscored —

CVE-2022-2078 Public exploit

A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jun 30, 2022
Unscored —

CVE-2022-23960

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-B…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine

Mar 12, 2022
Unscored —

CVE-2022-24448

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Feb 4, 2022
Unscored —

CVE-2022-2639 Public exploit

An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 1, 2022
Unscored —

CVE-2022-27950

In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error conditi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 28, 2022
Unscored —

CVE-2022-28390

ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 3, 2022
Unscored —

CVE-2022-28893

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the i…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 11, 2022
Unscored —

CVE-2022-2938

A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by d…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 23, 2022

References

report
https://access.redhat.com/security/cve/CVE-2020-36516
report
https://access.redhat.com/security/cve/CVE-2020-36558
report
https://access.redhat.com/security/cve/CVE-2021-30002
report
https://access.redhat.com/security/cve/CVE-2021-3640
report
https://access.redhat.com/security/cve/CVE-2022-0168
report
https://access.redhat.com/security/cve/CVE-2022-0617
report
https://access.redhat.com/security/cve/CVE-2022-0854
report
https://access.redhat.com/security/cve/CVE-2022-1016
report
https://access.redhat.com/security/cve/CVE-2022-1048
report
https://access.redhat.com/security/cve/CVE-2022-1055
report
https://access.redhat.com/security/cve/CVE-2022-1184
report
https://access.redhat.com/security/cve/CVE-2022-1852
report
https://access.redhat.com/security/cve/CVE-2022-20368
report
https://access.redhat.com/security/cve/CVE-2022-2078
report
https://access.redhat.com/security/cve/CVE-2022-21499
report
https://access.redhat.com/security/cve/CVE-2022-23960
report
https://access.redhat.com/security/cve/CVE-2022-24448
report
https://access.redhat.com/security/cve/CVE-2022-2586
report
https://access.redhat.com/security/cve/CVE-2022-26373
report
https://access.redhat.com/security/cve/CVE-2022-2639
report
https://access.redhat.com/security/cve/CVE-2022-27950
report
https://access.redhat.com/security/cve/CVE-2022-28390
report
https://access.redhat.com/security/cve/CVE-2022-28893
report
https://access.redhat.com/security/cve/CVE-2022-2938
report
https://access.redhat.com/security/cve/CVE-2022-29581
report
https://access.redhat.com/security/cve/CVE-2022-36946
report
https://bugzilla.redhat.com/1946279
report
https://bugzilla.redhat.com/1980646
report
https://bugzilla.redhat.com/2037386
report
https://bugzilla.redhat.com/2051444
report
https://bugzilla.redhat.com/2053632
report
https://bugzilla.redhat.com/2058395
report
https://bugzilla.redhat.com/2059928
report
https://bugzilla.redhat.com/2062284
report
https://bugzilla.redhat.com/2066614
report
https://bugzilla.redhat.com/2066706
report
https://bugzilla.redhat.com/2069408
report
https://bugzilla.redhat.com/2070205
report
https://bugzilla.redhat.com/2070220

Moderate: kernel security, bug fix, and enhancement update

Summary

Fixed packages 25

Vulnerabilities 26

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…

Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…

An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …

A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and gen…

An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …

A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…

A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers ud…

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw al…

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PC…

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…

A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in th…

Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel

A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-B…

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…

An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…

In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error conditi…

ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the i…

A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by d…

References