Red Hat Security Advisory: kernel security update

Fixed packages 143

Vulnerabilities 17

• Critical 9.8
  CVE-2024-46697

  nfsd: ensure that nfsd4_fattr_args.context is zeroed out

  In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 13, 2024
• High 8.4
  CVE-2024-50115

  KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory

  In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• High 8.0
  CVE-2024-50124

  Bluetooth: ISO: Fix UAF on iso_sock_timeout

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on iso_sock_timeout conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock so this checks if the conn->sk is still valid by checking if it part of iso…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• High 8.0
  CVE-2024-50125

  Bluetooth: SCO: Fix UAF on sco_sock_timeout

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• High 7.8
  CVE-2024-38564

  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

  In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_cre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• High 7.8
  CVE-2024-45020

  bpf: Fix a kernel verifier crash in stacksafe()

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2024
• High 7.8
  CVE-2024-47675

  bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() If bpf_link_prime() fails, bpf_uprobe_multi_link_attach() goes to the error_free label and frees the array of bpf_uprobe's without ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 21, 2024
• High 7.8
  CVE-2024-50262

  bpf: Fix out-of-bounds write in trie_get_next_key()

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 9, 2024
• High 7.3
  CVE-2024-50099

  arm64: probes: Remove broken LDR (literal) uprobe support

  In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_literal() and simulate_ldrsw_literal() functions are unsafe to use for uprobes. Both functions were originally writt…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• Medium 5.5
  CVE-2024-50110

  xfrm: fix one more kernel-infoleak in algo dumping

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a3…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• Medium 5.5
  CVE-2024-50142

  xfrm: validate new SA's prefixlen using SA family when sel.family is unset

  In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm se…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2024
• Medium 5.5
  CVE-2024-50148

  Bluetooth: bnep: fix wild-memory-access in proto_unregister

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as follows: KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f] CPU: 3 UID: 0 PID: 2805 Comm: rmmod …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2024
• Medium 5.5
  CVE-2024-50223

  sched/numa: Fix the potential null pointer dereference in task_numa_work()

  In the Linux kernel, the following vulnerability has been resolved: sched/numa: Fix the potential null pointer dereference in task_numa_work() When running stress-ng-vm-segv test, we found a null pointer dereference error in task_numa_work(). Here is the back…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 9, 2024
• Medium 5.5
  CVE-2024-50255

  Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. __hci_cmd_sync_sk() returns NULL if a command returns a status …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 9, 2024
• Medium 4.7
  CVE-2024-50192

  irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

  In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has al…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 8, 2024
• Unscored —
  CVE-2024-27399

  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 13, 2024
• Unscored —
  CVE-2024-49888

  bpf: Fix a sdiv overflow issue

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a sdiv overflow issue Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI The failu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 21, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2311717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312085
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320517
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323904
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323930
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323955
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324315
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324612
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324892
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11486.json
• report
  https://access.redhat.com/security/cve/CVE-2024-27399
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27399
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27399
• article
  https://lore.kernel.org/linux-cve-announce/2024051300-CVE-2024-27399-afa8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-38564
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-38564
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-38564
• article
  https://lore.kernel.org/linux-cve-announce/2024061955-CVE-2024-38564-b069@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-45020
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-45020
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-45020
• article
  https://lore.kernel.org/linux-cve-announce/2024091108-CVE-2024-45020-afcc@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-46697
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-46697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-46697
• article
  https://lore.kernel.org/linux-cve-announce/2024091341-CVE-2024-46697-d166@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-47675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47675
• article
  https://lore.kernel.org/linux-cve-announce/2024102103-CVE-2024-47675-643d@gregkh/T