Red Hat Security Advisory: kpatch-patch security update

Fixed packages 18

Vulnerabilities 3

• High 8.2
  CVE-2023-2008 Public exploit

  Kernel: udmabuf: improper validation of array index leading to local privilege escalation

  A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escal…

  Linux Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Apr 14, 2023
• High 7.8
  CVE-2023-0461 Public exploit

  Use-after-free vulnerability in the Linux Kernel

  There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not …

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 28, 2023
• High 7.8
  CVE-2023-32233 Public exploit EPSS 13%

  In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux Alpine
  May 8, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2176192
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196105
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3490.json
• report
  https://access.redhat.com/security/cve/CVE-2023-0461
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0461
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0461
• article
  https://github.com/torvalds/linux/commit/2c02d41d71f90a5168391b6a5f2954112ba2307c
• report
  https://access.redhat.com/security/cve/CVE-2023-2008
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2008
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2008
• article
  https://www.zerodayinitiative.com/advisories/ZDI-23-441/
• report
  https://access.redhat.com/security/cve/CVE-2023-32233
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32233
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32233
• article
  https://github.com/torvalds/linux/commit/c1592a89942e9678f7d9c8030efa777c0d57edab
• article
  https://www.openwall.com/lists/oss-security/2023/05/08/4