Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 13

• Critical 9.8
  CVE-2021-47548

  ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

  In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 24, 2024
• Critical 9.1
  CVE-2024-35960

  net/mlx5: Properly link new fs rules into the tree

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• High 8.1
  CVE-2022-48743

  net: amd-xgbe: Fix skb data length underflow

  In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 20, 2024
• High 7.8
  CVE-2023-52667

  net/mlx5e: fix a potential double-free in fs_any_create_groups

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fs_any_create_groups When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fs_any_create_groups() will free ft->g. However, its caller fs_an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 7.8
  CVE-2024-26852

  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

  In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_rout…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.8
  CVE-2024-36020

  i40e: fix vf may be used uninitialized in this function warning

  In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.5
  CVE-2024-36929

  net: core: reject skb_copy(_expand) for fraglist GSO skbs

  In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2023-52784

  bonding: stop the device in bond_setup_by_slave()

  In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the fo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2024-26733

  arp: Prevent overflow in arp_req_get().

  In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• Unscored —
  CVE-2024-26908 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Apr 17, 2024
• Unscored —
  CVE-2024-36025

  scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-36924

  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 30, 2024
• Unscored —
  CVE-2024-38596

  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writ…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275744
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282772
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283401
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284496
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293316
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293371
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4902.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47548
• article
  https://lore.kernel.org/linux-cve-announce/2024052441-CVE-2021-47548-e9c0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48743
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48743
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48743
• article
  https://lore.kernel.org/linux-cve-announce/2024062003-CVE-2022-48743-ee30@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52667
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52667
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52667
• article
  https://lore.kernel.org/linux-cve-announce/2024051728-CVE-2023-52667-649b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52784
• article
  https://lore.kernel.org/linux-cve-announce/2024052154-CVE-2023-52784-80ad@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26733
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26733
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26733
• article
  https://lore.kernel.org/linux-cve-announce/2024040358-CVE-2024-26733-617f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26852
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26852
• article
  https://lore.kernel.org/linux-cve-announce/2024041723-CVE-2024-26852-0057@gregkh/T