Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 17

• Critical 9.8
  CVE-2021-47548

  ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

  In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 24, 2024
• Critical 9.8
  CVE-2024-36886 Public exploit

  tipc: fix UAF in error path

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.8
  CVE-2024-27397

  netfilter: nf_tables: use timestamp to check for set element timeout

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 9, 2024
• High 7.8
  CVE-2024-35958

  net: ena: Fix incorrect descriptor free behavior

  In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• High 7.8
  CVE-2024-36904

  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

  In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.8
  CVE-2024-38663

  blk-cgroup: fix list corruption from resetting io stat

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from resetting io stat Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"), each iostat instance is added to blkcg percpu list, so blkcg_res…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2024
• High 7.5
  CVE-2024-27435

  nvme: fix reconnection fail due to reserved tag allocation

  In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, admin_q reconnect failed forever while remote target and netw…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2024
• Medium 5.5
  CVE-2022-48627

  vt: fix memory overlapping when deleting chars in the buffer

  In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpy…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Medium 5.5
  CVE-2024-38593

  net: micrel: Fix receiving the timestamp in the frame for lan8841

  In the Linux kernel, the following vulnerability has been resolved: net: micrel: Fix receiving the timestamp in the frame for lan8841 The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when the port was set down, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2021-47596

  net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg

  In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg Currently, the hns3_remove function firstly uninstall client instance, and then uninstall acceletion engine device. The netdevice is …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2023-52638

  can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• Unscored —
  CVE-2024-26783

  mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index

  In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index With numa balancing on, when a numa system is running where a numa node doesn't have its local memory so it has no managed…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 4, 2024
• Unscored —
  CVE-2024-26858

  net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map Just simply reordering the functions mlx5e_ptp_metadata_map_put and mlx5e_p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• Unscored —
  CVE-2024-36270

  netfilter: tproxy: bail out if IP has been disabled on the device

  In the Linux kernel, the following vulnerability has been resolved: netfilter: tproxy: bail out if IP has been disabled on the device syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• Unscored —
  CVE-2024-36957

  octeontx2-af: avoid off-by-one read from userspace

  In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count byt…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-38543

  lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure

  In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure The kcalloc() in dmirror_device_evict_chunk() will return null if the physical memory has run out. As a result, if src_pfns or …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• Unscored —
  CVE-2024-38586

  r8169: Fix possible ring buffer corruption on fragmented Tx packets.

  In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267509
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273082
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277238
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281925
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283401
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284541
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284581
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293380
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293653
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2294225
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4583.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47548
• article
  https://lore.kernel.org/linux-cve-announce/2024052441-CVE-2021-47548-e9c0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2021-47596
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47596
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47596
• article
  https://lore.kernel.org/linux-cve-announce/2024061920-CVE-2021-47596-cd94@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48627
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48627
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48627
• article
  https://lore.kernel.org/linux-cve-announce/2024030252-CVE-2022-48627-c7bf@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-52638
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52638
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52638
• article
  https://lore.kernel.org/linux-cve-announce/2024040334-CVE-2023-52638-26a6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26783
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26783
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26783
• article
  https://lore.kernel.org/linux-cve-announce/2024040458-CVE-2024-26783-68c8@gregkh/T