Red Hat Security Advisory: kernel security update

Fixed packages 43

Vulnerabilities 19

• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-40283

  An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 14, 2023
• High 7.8
  CVE-2023-4623

  Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-4921

  Use-after-free in Linux kernel's net/sched: sch_qfq component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 12, 2023
• High 7.8
  CVE-2023-5717 Public exploit

  Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 25, 2023
• High 7.8
  CVE-2023-6817

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 18, 2023
• High 7.1
  CVE-2022-41858

  A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jan 17, 2023
• High 7.1
  CVE-2023-6606

  Kernel: out-of-bounds read vulnerability in smbcalcsize

  An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Dec 8, 2023
• High 7.1
  CVE-2023-6610

  Kernel: oob access in smb2_dump_detail

  An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Dec 8, 2023
• High 7.0
  CVE-2023-46813 Public exploit

  An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 27, 2023
• High 7.0
  CVE-2024-0646

  Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 17, 2024
• Medium 6.6
  CVE-2023-1073

  A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 27, 2023
• Medium 6.5
  CVE-2023-6356

  Kernel: null pointer dereference in nvmet_tcp_build_iovec

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6535

  Kernel: null pointer dereference in nvmet_tcp_execute_request

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6536

  Kernel: null pointer dereference in __nvmet_req_complete

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Unscored —
  CVE-2023-1838

  A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 5, 2023
• Unscored —
  CVE-2023-45871

  An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 15, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2087568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245514
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254053
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254054
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255139
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0897.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3545
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3545
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3545
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a
• report
  https://access.redhat.com/security/cve/CVE-2022-41858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41858
• article
  https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798
• report
  https://access.redhat.com/security/cve/CVE-2023-1073
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1073
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1073
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=b12fece4c64857e5fab4290bf01b2e0317a88456
• article
  https://www.openwall.com/lists/oss-security/2023/01/17/3
• report
  https://access.redhat.com/security/cve/CVE-2023-1838
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1838
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1838
• article
  https://lore.kernel.org/netdev/20220516084213.26854-1-jasowang@redhat.com/T/
• report
  https://access.redhat.com/security/cve/CVE-2023-2166