Summary
- [5.14.0-284.30.0.1_2.OL9]
- x86/tsx: Add a feature bit for TSX control MSR support {CVE-2023-1637}
- x86/speculation: Restore speculation related MSRs {CVE-2023-1637}
- x86/pm: Save the MSR validity status at context setup {CVE-2023-1637}
- x86/pm: Fix false positive kmemleak report in msr_build_context() {CVE-2023-1637}
- x86/cpu: Restore AMD's DE_CFG MSR after resume {CVE-2023-1637}
- x86/pm: Add enumeration check before spec MSRs {CVE-2023-1637}
- arm64: efi: Execute runtime services from a dedicated {CVE-2023-21102}
- netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3390}
- netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain {CVE-2023-3390}
- netfilter: nf_tables: unbind non-anonymous set if rule construction fails {CVE-2023-3390}
- netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID {CVE-2023-4147}
- netfilter: nf_tables: do not ignore genmask when looking up chain by id {CVE-2023-31248}
- netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
- netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
- net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
Fixed packages 27
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bpftool | 0:7.0.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | perf | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-284.30.0.1.el9_2 |
| Oracle Linux · 9 | rtla | 0:5.14.0-284.30.0.1.el9_2 |
Vulnerabilities 8
-
High 7.8
In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error…
-
High 7.8
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
High 7.8CVE-2023-35001 Public exploit
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
-
High 7.8CVE-2023-3776 Public exploit
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the refere…
-
High 7.8
Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pr…
-
High 7.8CVE-2023-4147 Public exploit
Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
-
Medium 5.5
A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86…