Red Hat Security Advisory: kernel security update

Fixed packages 78

Vulnerabilities 13

• Critical 9.8
  CVE-2024-38570

  gfs2: Fix potential glock use-after-free on unmount

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Critical 9.1
  CVE-2024-35845

  wifi: iwlwifi: dbg-tlv: ensure NUL termination

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 8.1
  CVE-2023-52434

  smb: client: fix potential OOBs in smb2_parse_contexts()

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 20, 2024
• High 7.8
  CVE-2021-47069

  ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

  In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 1, 2024
• High 7.8
  CVE-2024-36016

  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

  In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 29, 2024
• High 7.8
  CVE-2024-36904

  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

  In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.7
  CVE-2021-47356

  mISDN: fix possible use-after-free in HFC_cleanup()

  In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the tim…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 7.5
  CVE-2023-52610

  net/sched: act_ct: fix skb leak and crash on ooo frags

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• High 7.0
  CVE-2023-52864

  platform/x86: wmi: Fix opening of char device

  In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Medium 5.5
  CVE-2024-36941

  wifi: nl80211: don't free NULL coalescing rule

  In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2021-47468

  isdn: mISDN: Fix sleeping function called from invalid context

  In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: Fix sleeping function called from invalid context The driver can call card->isac.release() function from an atomic context. Fix this by calling this function after releasing the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 22, 2024
• Unscored —
  CVE-2022-48793

  KVM: x86: nSVM: fix potential NULL derefernce on nested migration

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: nSVM: fix potential NULL derefernce on nested migration Turns out that due to review feedback and/or rebases I accidentally moved the call to nested_svm_load_cr3 to be too early, be…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024
• Unscored —
  CVE-2022-48799

  perf: Fix list corruption in perf_cgroup_switch()

  In the Linux kernel, the following vulnerability has been resolved: perf: Fix list corruption in perf_cgroup_switch() There's list corruption on cgrp_cpuctx_list. This happens on the following path: perf_cgroup_switch: list_for_each_entry(cgrp_cpuctx_list) cp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265285
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270080
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281272
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282394
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283894
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284474
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284541
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298129
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298135
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5692.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47069
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47069
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47069
• article
  https://lore.kernel.org/linux-cve-announce/2024030141-CVE-2021-47069-5797@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2021-47356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47356
• article
  https://lore.kernel.org/linux-cve-announce/2024052142-CVE-2021-47356-a3d4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2021-47468
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47468
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47468
• article
  https://lore.kernel.org/linux-cve-announce/2024052227-CVE-2021-47468-6c1b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48793
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48793
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48793
• article
  https://lore.kernel.org/linux-cve-announce/2024071641-CVE-2022-48793-3fc4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48799
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48799
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48799
• article
  https://lore.kernel.org/linux-cve-announce/2024071643-CVE-2022-48799-9594@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52434
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52434
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52434
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=17a0f64cc02d4972e21c733d9f21d1c512963afa