Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 85

Vulnerabilities 24

• Critical 10.0
  CVE-2023-2163 Public exploit

  Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

  Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 20, 2023
• High 8.2
  CVE-2023-39191

  Kernel: ebpf: insufficient stack type checks in dynptr

  An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 4, 2023
• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-3777

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner ru…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 6, 2023
• High 7.8
  CVE-2023-4015

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead un…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-40283

  An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 14, 2023
• High 7.8
  CVE-2023-4622 Public exploit

  Use-after-free in Linux kernel's af_unix component

  A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-4623

  Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-52973

  vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

  In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-5717 Public exploit

  Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 25, 2023
• High 7.1
  CVE-2022-41858

  A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jan 17, 2023
• High 7.1
  CVE-2023-3567

  Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

  A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.0
  CVE-2023-46813 Public exploit

  An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 27, 2023
• Medium 6.5
  CVE-2023-1192

  Use-after-free in smb2_is_status_io_timeout()

  A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses …

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Nov 1, 2023
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2023-2162

  A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-compone…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-6679

  Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c

  A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This issue could be exploited to trigger a denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Ubuntu
  Dec 11, 2023
• Unscored —
  CVE-2022-50879

  objtool: Fix SEGFAULT

  In the Linux kernel, the following vulnerability has been resolved: objtool: Fix SEGFAULT find_insn() will return NULL in case of failure. Check insn in order to avoid a kernel Oops for NULL pointer dereference.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-20569

  A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. …

  AMD 3rd Gen AMD EPYC™ Processors 2nd Gen AMD EPYC™ Processors 4th Gen AMD EPYC™ Processors Debian Ubuntu Alpine
  Aug 8, 2023
• Unscored —
  CVE-2023-38409

  An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Becaus…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 17, 2023
• Unscored —
  CVE-2023-45871

  An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 15, 2023
• Unscored —
  CVE-2023-52562

  mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()

  In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects befo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Unscored —
  CVE-2023-52942

  cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()

  In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2154178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207625
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2226783
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237752
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237760
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240249
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253986
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0448.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3545
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3545
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3545
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a
• report
  https://access.redhat.com/security/cve/CVE-2022-41858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41858
• article
  https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798
• report
  https://access.redhat.com/security/cve/CVE-2022-50879
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2426076
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50879
• article
  https://lore.kernel.org/linux-cve-announce/2025123024-CVE-2022-50879-47a7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-1192
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1192
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1192
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d527f51331cace562393a8038d870b3e9916686fCVE-2023-52