Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 18

• High 7.8
  CVE-2024-36971 Exploited Public exploit

  net: fix __dst_negative_advice() race

  In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 10, 2024

  KEV Aug 7, 2024
• Critical 9.8
  CVE-2023-52881

  tcp: do not accept ACK of bytes we never sent

  In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 g…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 29, 2024
• Critical 9.1
  CVE-2022-48828

  NFSD: Fix ia_size underflow

  In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file si…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024
• Critical 9.1
  CVE-2022-48829

  NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes

  In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024
• High 8.8
  CVE-2024-41090

  tap: add missing verification for short frame

  In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 8.8
  CVE-2024-41091

  tun: add missing verification for short frame

  In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 8.1
  CVE-2023-52885

  SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

  In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 14, 2024
• High 7.8
  CVE-2022-48637

  bnxt: prevent skb UAF after handing over to PTP worker

  In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is required bnxt_tx_int() hands over the ownership of the completed skb to the PTP worker. The skb should not…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 28, 2024
• High 7.8
  CVE-2023-52439

  uio: Fix use-after-free in uio_open

  In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_de…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 20, 2024
• High 7.8
  CVE-2024-39502

  ionic: fix use after netif_napi_del()

  In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.5
  CVE-2022-48827

  NFSD: Fix the behavior of READ near OFFSET_MAX

  In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024
• High 7.5
  CVE-2024-21823

  Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generatio…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 16, 2024
• Unscored —
  CVE-2021-47311

  net: qcom/emac: fix UAF in emac_remove

  In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netd…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2021-47385

  hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field If driver read val value sufficient for (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2021-47566

  proc/vmcore: fix clearing user buffer by properly using clear_user()

  In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 24, 2024
• Unscored —
  CVE-2023-52448

  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• Unscored —
  CVE-2024-35852

  mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as suppose…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2024
• Unscored —
  CVE-2024-36017

  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

  In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258875
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265653
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282355
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284417
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297474
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297730
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298168
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299240
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299336
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5281.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47311
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47311
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47311
• article
  https://lore.kernel.org/linux-cve-announce/2024052129-CVE-2021-47311-47f4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2021-47385
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47385
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47385
• article
  https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2021-47385-a7e7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2021-47566
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47566
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47566
• article
  https://lore.kernel.org/linux-cve-announce/2024052453-CVE-2021-47566-12b8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48637
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48637
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48637
• article
  https://lore.kernel.org/linux-cve-announce/2024042855-CVE-2022-48637-d149@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48827
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48827
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48827