Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-core | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-core | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-debuginfo | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-devel | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-kvm | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-modules | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-modules-extra | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debuginfo | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debuginfo-common-x86_64 | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-devel | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-kvm | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-modules | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-modules-extra | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-core | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-core | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-debuginfo | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-devel | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-modules | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-modules-extra | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debuginfo | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debuginfo-common-x86_64 | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-devel | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-modules | 0:4.18.0-513.5.1.rt7.307.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-modules-extra | 0:4.18.0-513.5.1.rt7.307.el8_9 |
Vulnerabilities 54
-
High 7.8
A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the devi…
-
High 7.8
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations s…
-
High 7.8
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8
Out-of-bounds write in Linux kernel's net/sched: sch_qfq component
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_route component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.1
An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …
-
High 7.0
Kernel: use after free bug in btsdio_remove due to race condition
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…
-
Medium 6.8
A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconn…
-
Medium 6.7
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode si…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
Medium 6.7
Kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to…
-
Medium 6.7
Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which m…
-
Medium 6.6
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…
-
Medium 6.5
Information exposure through microarchitectural state after transient execution in certain vector execution units for s…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
-
Medium 5.5
Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free
A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a pat…
-
Medium 5.5
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial o…
-
Medium 5.5
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the…
-
Medium 5.5
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a us…
-
Medium 5.5
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…
-
Medium 5.5
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…
-
Medium 5.5
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation…
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …
-
Medium 5.5
Kernel: smsusb: use-after-free caused by do_submit_urb()
A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.
-
Medium 5.3
Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…
-
Medium 5.3
Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…
-
Medium 5.3
Sev-es / sev-snp vmgexit double fetch vulnerability
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 4.7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…
-
Medium 4.7
A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Medium 4.7
Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
-
Low 3.3
A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessin…
-
Unscored —
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_ut…
-
Unscored —
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This f…
-
Unscored —CVE-2023-1206 Public exploit
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a use…
-
Unscored —
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_c…
-
Unscored —
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file …
-
Unscored —CVE-2023-35825 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2…
-
Unscored —
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record i…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index
-
article
https://access.redhat.com/solutions/7027704
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2024989
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2073091
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2133453
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2133455
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2139610
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2147356
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2148520
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2149024
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2151317
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2156322
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2165741
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2165926
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2168332
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173403
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173430
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173434
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173444
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2174400
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2175903
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2176140
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2177371
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2177389
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2181330
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182443
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2184578
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2185945
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2187257
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2188468
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2192667
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2192671
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2193097
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2193219
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2213139
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2213199
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2213485
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2213802