Red Hat Security Advisory: kernel security update

Fixed packages 84

Vulnerabilities 11

• Critical 9.8
  CVE-2024-26853

  igc: avoid returning frame twice in XDP_REDIRECT

  In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 17, 2024
• Critical 9.1
  CVE-2023-52735

  bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

  In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 8.8
  CVE-2024-41090

  tap: add missing verification for short frame

  In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 8.8
  CVE-2024-41091

  tun: add missing verification for short frame

  In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 7.8
  CVE-2024-36883

  net: fix out-of-bounds access in ops_init

  In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2023-52463

  efivarfs: force RO when remounting if SetVariable is not supported

  In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 23, 2024
• Unscored —
  CVE-2024-36000

  mm/hugetlb: fix missing hugetlb_lock for resv uncharge

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 20, 2024
• Unscored —
  CVE-2024-38608

  net/mlx5e: Fix netif state handling

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix netif state handling mlx5e_suspend cleans resources only if netif_device_present() returns true. However, mlx5e_resume changes the state of netif, via mlx5e_nic_enable, only if…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• Unscored —
  CVE-2024-40995

  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41076

  NFSv4: Fix memory leak in nfs4_set_security_label

  In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label We leak nfs_fattr and nfs4_label every time we set a security xattr.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Unscored —
  CVE-2024-42107

  ice: Don't process extts if PTP is disabled

  In the Linux kernel, the following vulnerability has been resolved: ice: Don't process extts if PTP is disabled The ice_ptp_extts_event() function can race with ice_ptp_release() and result in a NULL pointer dereference which leads to a kernel panic. Panic oc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 30, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265797
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275748
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299240
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300453
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301766
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5672.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52463
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52463
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52463
• article
  https://lore.kernel.org/linux-cve-announce/2024022335-CVE-2023-52463-6195@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-52735
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52735
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52735
• article
  https://lore.kernel.org/linux-cve-announce/2024052100-CVE-2023-52735-4df1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26853
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26853
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26853
• article
  https://lore.kernel.org/linux-cve-announce/2024041723-CVE-2024-26853-b549@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-36000
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-36000
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-36000
• article
  https://lore.kernel.org/linux-cve-announce/2024052023-CVE-2024-36000-cfc4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-36883
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-36883
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-36883
• article
  https://lore.kernel.org/linux-cve-announce/2024053032-CVE-2024-36883-b892@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-38608
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-38608
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-38608
• article
  https://lore.kernel.org/linux-cve-announce/2024061920-CVE-2024-38608-4068@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-40995
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-40995