ALSA-2024:0897 — Important: kernel security update

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)
* kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)
* kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
* kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)
* kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)
* kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)
* kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)
* kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)
* kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)
* kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)
* kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)
* kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)
* kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)
* kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)
* kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)
* kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)
* kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)
* kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)
* kernel: SEV-ES local priv escalation (CVE-2023-46813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 24

Release	Package	Fixed in
AlmaLinux · 8	bpftool	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-abi-stablelists	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-core	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-cross-headers	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-debug	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-debug-core	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-debug-devel	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-debug-modules	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-debug-modules-extra	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-devel	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-doc	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-modules	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-modules-extra	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-tools	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-tools-libs	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-tools-libs-devel	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-zfcpdump	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-zfcpdump-core	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-zfcpdump-devel	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-zfcpdump-modules	4.18.0-513.18.1.el8_9
AlmaLinux · 8	kernel-zfcpdump-modules-extra	4.18.0-513.18.1.el8_9
AlmaLinux · 8	perf	4.18.0-513.18.1.el8_9
AlmaLinux · 8	python3-perf	4.18.0-513.18.1.el8_9

Vulnerabilities 19

High 7.8

CVE-2023-2176

A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 20, 2023
High 7.8

CVE-2023-40283

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 14, 2023
High 7.8

CVE-2023-4623

Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Sep 6, 2023
High 7.8

CVE-2023-4921

Use-after-free in Linux kernel's net/sched: sch_qfq component

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Sep 12, 2023
High 7.8

CVE-2023-5717 Public exploit

Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Oct 25, 2023
High 7.8

CVE-2023-6817

Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Dec 18, 2023
High 7.1

CVE-2022-41858

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux

Jan 17, 2023
High 7.1

CVE-2023-6606

Kernel: out-of-bounds read vulnerability in smbcalcsize

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Dec 8, 2023
High 7.1

CVE-2023-6610

Kernel: oob access in smb2_dump_detail

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Dec 8, 2023
High 7.0

CVE-2023-46813 Public exploit

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 27, 2023
High 7.0

CVE-2024-0646

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Jan 17, 2024
Medium 6.6

CVE-2023-1073

A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 27, 2023
Medium 6.5

CVE-2023-6356

Kernel: null pointer dereference in nvmet_tcp_build_iovec

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ke…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Feb 7, 2024
Medium 6.5

CVE-2023-6535

Kernel: null pointer dereference in nvmet_tcp_execute_request

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Feb 7, 2024
Medium 6.5

CVE-2023-6536

Kernel: null pointer dereference in __nvmet_req_complete

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Feb 7, 2024
Medium 5.5

CVE-2022-3545

Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Oct 17, 2022
Medium 5.5

CVE-2023-2166

A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux

Apr 19, 2023
Unscored —

CVE-2023-1838

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 5, 2023
Unscored —

CVE-2023-45871

An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 15, 2023

References

report
https://access.redhat.com/security/cve/CVE-2022-3545
report
https://access.redhat.com/security/cve/CVE-2022-41858
report
https://access.redhat.com/security/cve/CVE-2023-1073
report
https://access.redhat.com/security/cve/CVE-2023-1838
report
https://access.redhat.com/security/cve/CVE-2023-2166
report
https://access.redhat.com/security/cve/CVE-2023-2176
report
https://access.redhat.com/security/cve/CVE-2023-40283
report
https://access.redhat.com/security/cve/CVE-2023-45871
report
https://access.redhat.com/security/cve/CVE-2023-4623
report
https://access.redhat.com/security/cve/CVE-2023-46813
report
https://access.redhat.com/security/cve/CVE-2023-4921
report
https://access.redhat.com/security/cve/CVE-2023-5717
report
https://access.redhat.com/security/cve/CVE-2023-6356
report
https://access.redhat.com/security/cve/CVE-2023-6535
report
https://access.redhat.com/security/cve/CVE-2023-6536
report
https://access.redhat.com/security/cve/CVE-2023-6606
report
https://access.redhat.com/security/cve/CVE-2023-6610
report
https://access.redhat.com/security/cve/CVE-2023-6817
report
https://access.redhat.com/security/cve/CVE-2024-0646
report
https://bugzilla.redhat.com/2087568
report
https://bugzilla.redhat.com/2144379
report
https://bugzilla.redhat.com/2161310
report
https://bugzilla.redhat.com/2173403
report
https://bugzilla.redhat.com/2187813
report
https://bugzilla.redhat.com/2187931
report
https://bugzilla.redhat.com/2231800
report
https://bugzilla.redhat.com/2237757
report
https://bugzilla.redhat.com/2244723
report
https://bugzilla.redhat.com/2245514
report
https://bugzilla.redhat.com/2246944
report
https://bugzilla.redhat.com/2246945
report
https://bugzilla.redhat.com/2253611
report
https://bugzilla.redhat.com/2253614
report
https://bugzilla.redhat.com/2253908
report
https://bugzilla.redhat.com/2254052
report
https://bugzilla.redhat.com/2254053
report
https://bugzilla.redhat.com/2254054
report
https://bugzilla.redhat.com/2255139
advisory
https://errata.almalinux.org/8/ALSA-2024-0897.html

Important: kernel security update

Summary

Fixed packages 24

Vulnerabilities 19

A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

Use-after-free in Linux kernel's net/sched: sch_qfq component

Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

Use-after-free in Linux kernel's netfilter: nf_tables component

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

Kernel: out-of-bounds read vulnerability in smbcalcsize

Kernel: oob access in smb2_dump_detail

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…

Kernel: null pointer dereference in nvmet_tcp_build_iovec

Kernel: null pointer dereference in nvmet_tcp_execute_request

Kernel: null pointer dereference in __nvmet_req_complete

Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…

An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…

References