Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 18

• High 8.1
  CVE-2022-48743

  net: amd-xgbe: Fix skb data length underflow

  In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 20, 2024
• High 7.8
  CVE-2021-47459

  can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 22, 2024
• High 7.8
  CVE-2024-26737

  bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• High 7.8
  CVE-2024-26773

  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid alloc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• High 7.8
  CVE-2024-26852

  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

  In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_rout…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.8
  CVE-2024-26880

  dm: call the resume method on internal suspend

  In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.8
  CVE-2024-27030

  octeontx2-af: Use separate handlers for interrupts

  In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• High 7.8
  CVE-2024-38580

  epoll: be better about file lifetimes

  In the Linux kernel, the following vulnerability has been resolved: epoll: be better about file lifetimes epoll can call out to vfs_poll() with a file pointer that may race with the last 'fput()'. That would make f_count go down to zero, and while the ep->mtx…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• High 7.5
  CVE-2024-35857

  icmp: prevent possible NULL dereferences from icmp_build_probe()

  In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && _…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2024
• Unscored —
  CVE-2023-52458

  block: add check that partition length needs to be aligned with block size

  In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logica…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 23, 2024
• Unscored —
  CVE-2023-52809

  scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

  In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NU…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2024-26982

  Squashfs: check the inode number is not the invalid value of zero

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-27046

  nfp: flower: handle acti_netdevs allocation failure

  In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-35885

  mlxbf_gige: stop interface during shutdown

  In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: stop interface during shutdown The mlxbf_gige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbf_driver wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• Unscored —
  CVE-2024-35907

  mlxbf_gige: call request_irq() after NAPI initialized

  In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: call request_irq() after NAPI initialized The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. The sequence to reproduce the excep…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• Unscored —
  CVE-2024-35952

  drm/ast: Fix soft lockup

  In the Linux kernel, the following vulnerability has been resolved: drm/ast: Fix soft lockup There is a while-loop in ast_dp_set_on_off() that could lead to infinite-loop. This is because the register, VGACRI-Dx, checked in this API is a scratch register actu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• Unscored —
  CVE-2024-36924

  scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 30, 2024
• Unscored —
  CVE-2024-36952

  scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265794
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273236
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275690
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278473
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281700
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282898
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284598
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293316
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293412
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4928.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47459
• article
  https://lore.kernel.org/linux-cve-announce/2024052224-CVE-2021-47459-4f79@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48743
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48743
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48743
• article
  https://lore.kernel.org/linux-cve-announce/2024062003-CVE-2022-48743-ee30@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52458
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52458
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52458
• article
  https://lore.kernel.org/linux-cve-announce/2024022332-CVE-2023-52458-d1cd@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-52809
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52809
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52809
• article
  https://lore.kernel.org/linux-cve-announce/2024052102-CVE-2023-52809-f07c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26737
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26737
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26737
• article
  https://lore.kernel.org/linux-cve-announce/2024040359-CVE-2024-26737-a9c3@gregkh/T