Red Hat Security Advisory: kernel security update

Fixed packages 136

Vulnerabilities 11

• High 7.8
  CVE-2023-4244

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-51042

  In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 23, 2024
• High 7.8
  CVE-2023-5717 Public exploit

  Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 25, 2023
• High 7.8
  CVE-2023-6817

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 18, 2023
• High 7.8
  CVE-2024-0193

  Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

  A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Jan 2, 2024
• High 7.1
  CVE-2023-6606

  Kernel: out-of-bounds read vulnerability in smbcalcsize

  An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Dec 8, 2023
• High 7.1
  CVE-2023-6610

  Kernel: oob access in smb2_dump_detail

  An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Dec 8, 2023
• High 7.0
  CVE-2024-0646

  Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 17, 2024
• Medium 6.5
  CVE-2023-6356

  Kernel: null pointer dereference in nvmet_tcp_build_iovec

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6535

  Kernel: null pointer dereference in nvmet_tcp_execute_request

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6536

  Kernel: null pointer dereference in __nvmet_req_complete

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254053
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254054
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255653
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259866
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1248.json
• report
  https://access.redhat.com/security/cve/CVE-2023-4244
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4244
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4244
• article
  https://lore.kernel.org/netdev/20230810070830.24064-1-pablo@netfilter.org/
• article
  https://lore.kernel.org/netdev/20230815223011.7019-1-fw@strlen.de/
• report
  https://access.redhat.com/security/cve/CVE-2023-5717
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5717
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/events?id=32671e3799ca2e4590773fd0e63aaa4229e50c06
• report
  https://access.redhat.com/security/cve/CVE-2023-6356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6356
• report
  https://access.redhat.com/security/cve/CVE-2023-6535
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6535
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6535
• report
  https://access.redhat.com/security/cve/CVE-2023-6536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6536
• report
  https://access.redhat.com/security/cve/CVE-2023-6606
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6606
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6606
• article
  https://bugzilla.kernel.org/show_bug.cgi?id=218218
• report
  https://access.redhat.com/security/cve/CVE-2023-6610
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6610
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6610
• article
  https://bugzilla.kernel.org/show_bug.cgi?id=218219