Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 27

• Critical 9.8
  CVE-2024-41040

  net/sched: Fix UAF when resolving a clash

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff88…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Critical 9.8
  CVE-2024-41073

  nvme: avoid double free special payload

  In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECI…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• High 8.8
  CVE-2023-52801

  iommufd: Fix missing update of domains_itree after splitting iopt_area

  In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 8.4
  CVE-2024-35875

  x86/coco: Require seeding RNG with RDRAND on CoCo systems

  In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model mean…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• High 7.8
  CVE-2024-35791

  KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()

  In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-fre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 7.8
  CVE-2024-36019

  regmap: maple: Fix cache corruption in regcache_maple_drop()

  In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.8
  CVE-2024-36883

  net: fix out-of-bounds access in ops_init

  In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.8
  CVE-2024-36979

  net: bridge: mst: fix vlan use-after-free

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• High 7.8
  CVE-2024-41096

  PCI/MSI: Fix UAF in msi_capability_init

  In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• High 7.1
  CVE-2024-26630

  mm: cachestat: fix folio read-after-free in cache walk

  In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix folio read-after-free in cache walk In cachestat, we access the folio from the page cache's xarray to compute its page offset, and check for its dirty and writeback flags. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 13, 2024
• High 7.1
  CVE-2024-35797

  mm: cachestat: fix two shmem bugs

  In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• Medium 6.5
  CVE-2024-26886

  Bluetooth: af_bluetooth: Fix deadlock

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 17, 2024
• Medium 4.4
  CVE-2024-38559

  scsi: qedf: Ensure the copied buf is NUL terminated

  In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer bu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2023-52463

  efivarfs: force RO when remounting if SetVariable is not supported

  In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 23, 2024
• Unscored —
  CVE-2024-26629

  nfsd: fix RELEASE_LOCKOWNER

  In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is doc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 13, 2024
• Unscored —
  CVE-2024-26720 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Apr 3, 2024
• Unscored —
  CVE-2024-26946

  kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address

  In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-36000

  mm/hugetlb: fix missing hugetlb_lock for resv uncharge

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 20, 2024
• Unscored —
  CVE-2024-38619

  usb-storage: alauda: Check whether the media is initialized

  In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alaud…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 20, 2024
• Unscored —
  CVE-2024-40927

  xhci: Handle TD clearing for multiple streams case

  In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40936

  cxl/region: Fix memregion leaks in devm_cxl_add_region()

  In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix memregion leaks in devm_cxl_add_region() Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41044

  ppp: reject claimed-as-LCP but actually malformed packets

  In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-41055

  mm: prevent derefencing NULL ptr in pfn_section_valid()

  In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Unscored —
  CVE-2024-42082

  xdp: Remove WARN() from __xdp_reg_mem_model()

  In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN() from __xdp_reg_mem_model() syzkaller reports a warning in __xdp_reg_mem_model(). The warning occurs only if __mem_id_init_hash_table() returns an error. It returns the erro…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Unscored —
  CVE-2024-42096

  x86: stop playing stack games in profile_pc()

  In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with, but it also ends up m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-42102

  Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"

  In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 30, 2024
• Unscored —
  CVE-2024-42131

  mm: avoid overflows in dirty throttling logic

  In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 30, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265797
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2269434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2269436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273141
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278206
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281151
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281727
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282709
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293276
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300409
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300414
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300491
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300713
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301496
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301637
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6567.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52463
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52463
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52463
• article
  https://lore.kernel.org/linux-cve-announce/2024022335-CVE-2023-52463-6195@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-52801
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52801
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52801
• article
  https://lore.kernel.org/linux-cve-announce/2024052159-CVE-2023-52801-b287@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26629
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26629