Fixed packages 43
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | bpftool | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | bpftool-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-abi-stablelists | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-core | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debug | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debug-core | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debug-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debug-devel | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debug-modules | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debug-modules-extra | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debuginfo-common-aarch64 | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debuginfo-common-ppc64le | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debuginfo-common-s390x | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-debuginfo-common-x86_64 | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-devel | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-doc | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-modules | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-modules-extra | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-tools | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-tools-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-tools-libs | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-zfcpdump | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-zfcpdump-core | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-zfcpdump-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-zfcpdump-devel | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-zfcpdump-modules | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | kernel-zfcpdump-modules-extra | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | perf | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | perf-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | python3-perf | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos | python3-perf-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | bpftool-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-debug-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-debuginfo-common-aarch64 | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-debuginfo-common-ppc64le | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-debuginfo-common-x86_64 | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-tools-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | kernel-tools-libs-devel | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | perf-debuginfo | 0:4.18.0-477.74.1.el8_8 |
| Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb | python3-perf-debuginfo | 0:4.18.0-477.74.1.el8_8 |
Vulnerabilities 38
-
Critical 9.1
tunnels: fix out of bounds access when building IPv6 PMTU error
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/…
-
High 8.8
net: fix possible store tearing in neigh_periodic_work()
In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …
-
High 8.8
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item…
-
High 8.4
virtio-net: Add validation for used length
In the Linux kernel, the following vulnerability has been resolved: virtio-net: Add validation for used length This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss.
-
High 8.1
smb: client: fix potential OOBs in smb2_parse_contexts()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…
-
High 7.8
uio: Fix use-after-free in uio_open
In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_de…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…
-
High 7.8
af_unix: Fix garbage collector racing against connect()
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_table…
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_ta…
-
High 7.8
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with…
-
High 7.8
net: sched: sch_multiq: fix possible OOB write in multiq_tune()
In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used…
-
High 7.8
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of …
-
High 7.7
mISDN: fix possible use-after-free in HFC_cleanup()
In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the tim…
-
High 7.5
mptcp: fix data re-injection from stale subflow
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…
-
High 7.5
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vml…
-
High 7.5
net: core: reject skb_copy(_expand) for fraglist GSO skbs
In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…
-
High 7.5
cppc_cpufreq: Fix possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: cppc_cpufreq: Fix possible null pointer dereference cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() …
-
High 7.0
platform/x86: wmi: Fix opening of char device
In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp…
-
High 7.0
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() wi…
-
Medium 5.5
scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that th…
-
Medium 5.3
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If driver read tmp value sufficient for (tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0…
-
Medium 5.3
cgroup: cgroup_get_from_id() must check the looked-up kn is a directory
In the Linux kernel, the following vulnerability has been resolved: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be one kernfs dir, otherwise kernel panic is caused, especially cgroup id is provide from userspace.
-
Unscored —
isdn: mISDN: Fix sleeping function called from invalid context
In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: Fix sleeping function called from invalid context The driver can call card->isac.release() function from an atomic context. Fix this by calling this function after releasing the …
-
Unscored —
proc/vmcore: fix clearing user buffer by properly using clear_user()
In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a…
-
Unscored —
bonding: stop the device in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the fo…
-
Unscored —
hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 ("hv_netvsc: Disable NAPI before closing the VMBus channel"), napi_disable was getting called for a…
-
Unscored —CVE-2024-26908 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the…
-
Unscored —
netfilter: nf_tables: honor table dormant flag from netdev release event path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook…
-
Unscored —
netfilter: tproxy: bail out if IP has been disabled on the device
In the Linux kernel, the following vulnerability has been resolved: netfilter: tproxy: bail out if IP has been disabled on the device syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN …
-
Unscored —
md: fix resync softlockup when bitmap size is less than array size
In the Linux kernel, the following vulnerability has been resolved: md: fix resync softlockup when bitmap size is less than array size Is is reported that for dm-raid10, lvextend + lvchange --syncaction will trigger following softlockup: kernel:watchdog: BUG:…
-
Unscored —
cpufreq: exit() callback is optional
In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional and shouldn't be called without checking a valid pointer first. Also, we must clear freq_table pointer even if the exit() …
-
Unscored —
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …
-
Unscored —
ppp: reject claimed-as-LCP but actually malformed packets
In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP p…
-
Unscored —CVE-2024-41071 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
drm/amdgpu: avoid using null object of framebuffer
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object i…
-
Unscored —
tcp_metrics: validate source addr length
In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at al…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265271
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265285
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2267795
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2272793
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2273117
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2273242
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275604
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275744
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275750
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2277171
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2277829
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278256
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278258
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2280462
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281669
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281900
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281949
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282356
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282394
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282401
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282719
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282743
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282772
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282887
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2283463
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2283894
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284496
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293078
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293348
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293367
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293420
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293653
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297579
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300410
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300414
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300448
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300488
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2301522