Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 73

Vulnerabilities 11

• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-31436

  qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 28, 2023
• High 7.8
  CVE-2023-3611

  Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

  An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 21, 2023
• High 7.8
  CVE-2023-6817

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 18, 2023
• High 7.1
  CVE-2022-41858

  A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jan 17, 2023
• High 7.0
  CVE-2024-0646

  Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 17, 2024
• Medium 6.3
  CVE-2022-38096

  There is a NULL pointer vulnerability in vmwgfx driver

  A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2022
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-4459

  Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

  A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 21, 2023
• Medium 5.5
  CVE-2023-7192

  Kernel: refcount leak in ctnetlink_create_conntrack()

  A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133452
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2192671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2225191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2256279
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1367.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3545
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3545
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3545
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a
• report
  https://access.redhat.com/security/cve/CVE-2022-38096
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-38096
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-38096
• report
  https://access.redhat.com/security/cve/CVE-2022-41858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41858
• article
  https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798
• report
  https://access.redhat.com/security/cve/CVE-2023-2166
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2166
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2166
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0acc442309a0a1b01bcdaa135e56e6398a49439c
• report
  https://access.redhat.com/security/cve/CVE-2023-2176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2176
• article
  https://www.spinics.net/lists/linux-rdma/msg114749.html
• report
  https://access.redhat.com/security/cve/CVE-2023-3611
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3611
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3611
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64
• report
  https://access.redhat.com/security/cve/CVE-2023-4459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4459