Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
* kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
* kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
* kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
* kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
* kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
* kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
* kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
* hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
* kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
* kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
* kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
* kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
* kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
* kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
* kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
* kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
* kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
* kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
* kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
* kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
* kernel: denial of service in tipc_conn_close (CVE-2023-1382)
* kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
* kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
* kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
* kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
* kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
* kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
* kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
* kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
* Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
* kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
* kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
* kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
* kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
* kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
* kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
* kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
* kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
* kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
* kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
* kernel: Use after free bug in r592_remove (CVE-2023-3141)
* kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 25
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | bpftool | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-abi-stablelists | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-core | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-cross-headers | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-debug | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-debug-core | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-debug-devel | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-debug-modules | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-debug-modules-extra | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-devel | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-doc | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-headers | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-modules | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-modules-extra | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-tools | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-tools-libs | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-tools-libs-devel | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-zfcpdump | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-zfcpdump-core | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-zfcpdump-devel | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-zfcpdump-modules | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | kernel-zfcpdump-modules-extra | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | perf | 4.18.0-513.5.1.el8_9 |
| AlmaLinux · 8 | python3-perf | 4.18.0-513.5.1.el8_9 |
Vulnerabilities 53
-
High 7.8
A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the devi…
-
High 7.8
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations s…
-
High 7.8
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8
Out-of-bounds write in Linux kernel's net/sched: sch_qfq component
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_route component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.1
An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …
-
High 7.0
Kernel: use after free bug in btsdio_remove due to race condition
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…
-
Medium 6.8
A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconn…
-
Medium 6.7
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode si…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
Medium 6.7
Kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to…
-
Medium 6.7
Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which m…
-
Medium 6.6
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…
-
Medium 6.5
Information exposure through microarchitectural state after transient execution in certain vector execution units for s…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
-
Medium 5.5
Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a pat…
-
Medium 5.5
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial o…
-
Medium 5.5
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the…
-
Medium 5.5
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a us…
-
Medium 5.5
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…
-
Medium 5.5
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…
-
Medium 5.5
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation…
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …
-
Medium 5.5
Kernel: smsusb: use-after-free caused by do_submit_urb()
A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.
-
Medium 5.3
Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 5.3
Sev-es / sev-snp vmgexit double fetch vulnerability
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 4.7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…
-
Medium 4.7
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Medium 4.7
Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
-
Low 3.3
A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessin…
-
Unscored —
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_ut…
-
Unscored —
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This f…
-
Unscored —CVE-2023-1206 Public exploit
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a use…
-
Unscored —
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file …
-
Unscored —CVE-2023-35825 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2…
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…
References
-
report
https://access.redhat.com/security/cve/CVE-2021-43975
-
report
https://access.redhat.com/security/cve/CVE-2022-28388
-
report
https://access.redhat.com/security/cve/CVE-2022-3594
-
report
https://access.redhat.com/security/cve/CVE-2022-3640
-
report
https://access.redhat.com/security/cve/CVE-2022-38457
-
report
https://access.redhat.com/security/cve/CVE-2022-40133
-
report
https://access.redhat.com/security/cve/CVE-2022-40982
-
report
https://access.redhat.com/security/cve/CVE-2022-42895
-
report
https://access.redhat.com/security/cve/CVE-2022-45869
-
report
https://access.redhat.com/security/cve/CVE-2022-45887
-
report
https://access.redhat.com/security/cve/CVE-2022-4744
-
report
https://access.redhat.com/security/cve/CVE-2023-0458
-
report
https://access.redhat.com/security/cve/CVE-2023-0590
-
report
https://access.redhat.com/security/cve/CVE-2023-0597
-
report
https://access.redhat.com/security/cve/CVE-2023-1073
-
report
https://access.redhat.com/security/cve/CVE-2023-1074
-
report
https://access.redhat.com/security/cve/CVE-2023-1075
-
report
https://access.redhat.com/security/cve/CVE-2023-1079
-
report
https://access.redhat.com/security/cve/CVE-2023-1118
-
report
https://access.redhat.com/security/cve/CVE-2023-1206
-
report
https://access.redhat.com/security/cve/CVE-2023-1252
-
report
https://access.redhat.com/security/cve/CVE-2023-1382
-
report
https://access.redhat.com/security/cve/CVE-2023-1855
-
report
https://access.redhat.com/security/cve/CVE-2023-1989
-
report
https://access.redhat.com/security/cve/CVE-2023-1998
-
report
https://access.redhat.com/security/cve/CVE-2023-23455
-
report
https://access.redhat.com/security/cve/CVE-2023-2513
-
report
https://access.redhat.com/security/cve/CVE-2023-26545
-
report
https://access.redhat.com/security/cve/CVE-2023-28328
-
report
https://access.redhat.com/security/cve/CVE-2023-28772
-
report
https://access.redhat.com/security/cve/CVE-2023-30456
-
report
https://access.redhat.com/security/cve/CVE-2023-31084
-
report
https://access.redhat.com/security/cve/CVE-2023-3141
-
report
https://access.redhat.com/security/cve/CVE-2023-31436
-
report
https://access.redhat.com/security/cve/CVE-2023-3161
-
report
https://access.redhat.com/security/cve/CVE-2023-3212
-
report
https://access.redhat.com/security/cve/CVE-2023-3268
-
report
https://access.redhat.com/security/cve/CVE-2023-33203
-
report
https://access.redhat.com/security/cve/CVE-2023-33951