Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 28

Vulnerabilities 34

• Medium 5.3
  CVE-2022-2586 Exploited Public exploit EPSS 10%

  It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…

  The Linux Kernel Organization linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 8, 2024

  KEV Jun 26, 2024
• High 8.6
  CVE-2022-1055

  Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel

  A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 29, 2022
• High 7.8
  CVE-2021-47099

  veth: ensure skb entering GRO are not cloned.

  In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer devi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 4, 2024
• High 7.8
  CVE-2022-29581 Public exploit

  Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2022
• High 7.5
  CVE-2022-36946 Public exploit

  nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 27, 2022
• High 7.1
  CVE-2021-47580

  scsi: scsi_debug: Fix type in min_t to avoid stack OOB

  In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix type in min_t to avoid stack OOB Change min_t() to use type "u32" instead of type "int" to avoid stack out of bounds. With min_t() type "int" the values get sign extende…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Medium 6.9
  CVE-2022-2503

  Linux Kernel LoadPin bypass via dm-verity table reload

  Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …

  Linux kernel Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 12, 2022
• Medium 6.7
  CVE-2022-20572

  In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission c…

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Dec 16, 2022
• Medium 6.7
  CVE-2022-21499

  KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…

  Oracle Oracle Linux Oracle VM linux-raspi2 Linux Debian Ubuntu
  Jun 9, 2022
• Medium 5.5
  CVE-2022-26373

  Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Aug 18, 2022
• Medium 5.5
  CVE-2022-3107

  An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Dec 14, 2022
• Unscored —
  CVE-2020-36516

  An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Feb 26, 2022
• Unscored —
  CVE-2020-36558

  A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and gen…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jul 21, 2022
• Unscored —
  CVE-2021-30002

  An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 2, 2021
• Unscored —
  CVE-2021-3640

  A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 3, 2022
• Unscored —
  CVE-2022-0168

  A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 26, 2022
• Unscored —
  CVE-2022-0617

  A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers ud…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 16, 2022
• Unscored —
  CVE-2022-0854

  A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw al…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 23, 2022
• Unscored —
  CVE-2022-1016

  A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 29, 2022
• Unscored —
  CVE-2022-1048

  A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PC…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 29, 2022
• Unscored —
  CVE-2022-1158

  A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get th…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 5, 2022
• Unscored —
  CVE-2022-1184

  A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Aug 29, 2022
• Unscored —
  CVE-2022-1263

  A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allo…

  linux-raspi2 linux-hwe linux-azure linux-riscv Virtualization Debian Ubuntu Azure Linux
  Aug 31, 2022
• Unscored —
  CVE-2022-1852

  A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in th…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 30, 2022
• Unscored —
  CVE-2022-20368

  Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Aug 11, 2022
• Unscored —
  CVE-2022-2078 Public exploit

  A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 30, 2022
• Unscored —
  CVE-2022-2153

  A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbe…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 31, 2022
• Unscored —
  CVE-2022-24448

  An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 4, 2022
• Unscored —
  CVE-2022-2639 Public exploit

  An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 1, 2022
• Unscored —
  CVE-2022-27950

  In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error conditi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 28, 2022
• Unscored —
  CVE-2022-28390

  ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 3, 2022
• Unscored —
  CVE-2022-28893

  The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the i…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 11, 2022
• Unscored —
  CVE-2022-2938

  A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by d…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 23, 2022
• Unscored —
  CVE-2022-48918

  iwlwifi: mvm: check debugfs_dir ptr before use

  In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mvm: check debugfs_dir ptr before use When "debugfs=off" is used on the kernel command line, iwiwifi's mvm module uses an invalid/unchecked debugfs_dir pointer and causes a BUG: BUG:…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 22, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index
• article
  https://access.redhat.com/solutions/6971358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1946279
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2037386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2037769
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2051444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2058395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2059928
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066706
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2069408
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2070205
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2070220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074208
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2084183
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2084479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2088021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2089815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2096178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2112693
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2114878
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2115065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2115278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120175
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2123695
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7444.json
• report
  https://access.redhat.com/security/cve/CVE-2020-36516
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36516
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36516
• article
  https://www.spinics.net/lists/netdev/msg795642.html
• report
  https://access.redhat.com/security/cve/CVE-2020-36558
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36558
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36558
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cd1ed50efd88261298577cd92a14f2768eddeeb
• report
  https://access.redhat.com/security/cve/CVE-2021-3640