Summary
- [5.14.0-362.18.0.1_3.OL9]
- nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
- drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
- can: af_can: fix NULL pointer dereference in can_rcv_filter (Oliver Hartkopp) {CVE-2023-2166}
- RDMA/core: Fix resolve_prepare_src error cleanup (Patrisious Haddad) {CVE-2023-2176}
- netfilter: nf_tables: skip bound chain on rule flush (Pablo Neira Ayuso} {CVE-2023-3777}
- net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
- netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Pablo Neira Ayuso) {CVE-2023-4015}
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) {CVE-2023-4622}
- nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg) {CVE-2023-5178}
- fbcon: set_con2fb_map needs to set con2fb_map! (Daniel Vetter) {CVE-2023-38409}
- fbcon: Fix error paths in set_con2fb_map (Daniel Vetter) {CVE-2023-38409}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) {CVE-2023-40283)
- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng) {CVE-2023-42753}
- x86/sev: Check IOBM for IOIO exceptions from user-space (Joerg Roedel) {CVE-2023-46813}
- x86/sev: Disable MMIO emulation from user mode (Borislav Petkov) {CVE-2023-46813}
- x86/sev: Check for user-space IOIO pointing to kernel space (Joerg Roedel) {CVE-2023-46813}
Fixed packages 27
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bpftool | 0:7.2.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | libperf | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | perf | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | rtla | 0:5.14.0-362.18.0.1.el9_3 |
| Oracle Linux · 9 | rv | 0:5.14.0-362.18.0.1.el9_3 |
Vulnerabilities 13
-
High 8.8CVE-2023-5178 Public exploit
Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…
-
High 7.8
A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner ru…
-
High 7.8
Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags
An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate …
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead un…
-
High 7.8
An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…
-
High 7.8CVE-2023-4622 Public exploit
Use-after-free in Linux kernel's af_unix component
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…
-
High 7.1
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…
-
High 7.0
Kernel: netfilter: potential slab-out-of-bound access due to integer underflow
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer o…
-
High 7.0CVE-2023-46813 Public exploit
An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…
-
Medium 5.5
Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free
A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…
-
Medium 5.5
A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…
-
Unscored —
An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Becaus…