Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 28

Vulnerabilities 20

• Critical 10.0
  CVE-2023-2163 Public exploit

  Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

  Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 20, 2023
• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-3390 Public exploit

  Use-after-free in Linux kernel's netfilter subsystem

  A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 28, 2023
• High 7.8
  CVE-2023-3609 Public exploit

  Use-after-free in Linux kernel's net/sched: cls_u32 component

  A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 21, 2023
• High 7.8
  CVE-2023-40283

  An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 14, 2023
• High 7.8
  CVE-2023-4622 Public exploit

  Use-after-free in Linux kernel's af_unix component

  A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-5717 Public exploit

  Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 25, 2023
• High 7.8
  CVE-2023-6932

  Use-after-free in Linux kernel's ipv4: igmp component

  A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 19, 2023
• High 7.1
  CVE-2023-3268

  An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 16, 2023
• High 7.0
  CVE-2023-6546 Public exploit

  Kernel: gsm multiplexing race condition leads to privilege escalation

  A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Dec 21, 2023
• High 7.0
  CVE-2024-0646

  Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 17, 2024
• Medium 6.5
  CVE-2022-40982

  Information exposure through microarchitectural state after transient execution in certain vector execution units for s…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine
  Aug 11, 2023
• Medium 6.5
  CVE-2023-1192

  Use-after-free in smb2_is_status_io_timeout()

  A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses …

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Nov 1, 2023
• Medium 6.3
  CVE-2022-38096

  There is a NULL pointer vulnerability in vmwgfx driver

  A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2022
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-4459

  Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

  A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 21, 2023
• Medium 5.5
  CVE-2023-7192

  Kernel: refcount leak in ctnetlink_create_conntrack()

  A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 2, 2024
• Unscored —
  CVE-2022-0480

  A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory ex…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Aug 29, 2022
• Unscored —
  CVE-2023-38409

  An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Becaus…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 17, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2049700
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133452
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2154178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2223949
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2225201
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230094
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237760
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240249
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255283
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2256279
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267695
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1306.json
• report
  https://access.redhat.com/security/cve/CVE-2022-0480
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0480
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0480
• article
  https://github.com/kata-containers/kata-containers/issues/3373
• article
  https://lore.kernel.org/linux-mm/20210902215519.AWcuVc3li%25akpm@linux-foundation.org/
• report
  https://access.redhat.com/security/cve/CVE-2022-3545
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3545
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3545
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a
• report
  https://access.redhat.com/security/cve/CVE-2022-38096
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38096
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38096
• report
  https://access.redhat.com/security/cve/CVE-2022-40982
• article
  https://access.redhat.com/solutions/7027704
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40982