Red Hat Security Advisory: kernel:5.14.0 security update

Fixed packages 141

Vulnerabilities 7

• High 7.8
  CVE-2024-27062

  nouveau: lock the client object tree.

  In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mapp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.8
  CVE-2024-41049

  filelock: fix potential use-after-free in posix_lock_inode

  In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a loc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 7.8
  CVE-2024-41064

  powerpc/eeh: avoid possible crash when edev->pdev changes

  In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 7.8
  CVE-2024-47675

  bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the error_free label and frees the array of bpf_uprobe's without ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 21, 2024
• High 7.8
  CVE-2024-50262

  bpf: Fix out-of-bounds write in trie_get_next_key()

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 9, 2024
• Unscored —
  CVE-2024-42124

  scsi: qedf: Make qedf_execute_tmf() non-preemptible

  In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Make qedf_execute_tmf() non-preemptible Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel. [ 659.3432…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 30, 2024
• Unscored —
  CVE-2024-49888

  bpf: Fix a sdiv overflow issue

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a sdiv overflow issue Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI The failu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 21, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278387
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301489
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320517
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324892
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10942.json
• report
  https://access.redhat.com/security/cve/CVE-2024-27062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27062
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27062
• article
  https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-27062-3291@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-41049
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-41049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-41049
• article
  https://lore.kernel.org/linux-cve-announce/2024072927-CVE-2024-41049-bf28@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-41064
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-41064
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-41064
• article
  https://lore.kernel.org/linux-cve-announce/2024072907-CVE-2024-41064-6ecb@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-42124
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-42124
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-42124
• article
  https://lore.kernel.org/linux-cve-announce/2024073025-CVE-2024-42124-e4ad@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-47675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47675
• article
  https://lore.kernel.org/linux-cve-announce/2024102103-CVE-2024-47675-643d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-49888
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-49888
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-49888
• article
  https://lore.kernel.org/linux-cve-announce/2024102117-CVE-2024-49888-027c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-50262
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50262
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50262
• article
  https://lore.kernel.org/linux-cve-announce/2024110955-CVE-2024-50262-9cd7@gregkh/T