Red Hat Security Advisory: kernel security update

Fixed packages 136

Vulnerabilities 17

• High 8.8
  CVE-2023-5178 Public exploit

  Kernel: use after free in nvmet_tcp_free_crypto in nvme

  A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Nov 1, 2023
• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-3777

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner ru…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 6, 2023
• High 7.8
  CVE-2023-3812

  Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

  An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.8
  CVE-2023-4015

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead un…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-40283

  An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 14, 2023
• High 7.8
  CVE-2023-4622 Public exploit

  Use-after-free in Linux kernel's af_unix component

  A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-4623

  Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-5633

  Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

  The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 23, 2023
• High 7.1
  CVE-2022-41858

  A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jan 17, 2023
• High 7.0
  CVE-2023-42753

  Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

  An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Sep 25, 2023
• High 7.0
  CVE-2023-46813 Public exploit

  An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 27, 2023
• Medium 6.3
  CVE-2022-36402

  There is an int overflow vulnerability in vmwgfx driver

  An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2022
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-6679

  Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c

  A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This issue could be exploited to trigger a denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Ubuntu
  Dec 11, 2023
• Unscored —
  CVE-2023-38409

  An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Becaus…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 17, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224048
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237752
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237760
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239843
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245663
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253986
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0461.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3545
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3545
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3545
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a
• report
  https://access.redhat.com/security/cve/CVE-2022-36402
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-36402
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-36402
• report
  https://access.redhat.com/security/cve/CVE-2022-41858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41858
• article
  https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798
• report
  https://access.redhat.com/security/cve/CVE-2023-2166
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2166
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2166
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0acc442309a0a1b01bcdaa135e56e6398a49439c
• report
  https://access.redhat.com/security/cve/CVE-2023-2176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2176
• article
  https://www.spinics.net/lists/linux-rdma/msg114749.html
• report
  https://access.redhat.com/security/cve/CVE-2023-3777