Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 21

• Critical 9.8
  CVE-2024-38570

  gfs2: Fix potential glock use-after-free on unmount

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• High 8.8
  CVE-2024-26931

  scsi: qla2xxx: Fix command flush on cable pull

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• High 8.3
  CVE-2024-42225

  wifi: mt76: replace skb_put with skb_put_zero

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 30, 2024
• High 7.8
  CVE-2023-52439

  uio: Fix use-after-free in uio_open

  In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_de…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 20, 2024
• High 7.8
  CVE-2024-26739

  net/sched: act_mirred: don't override retval if we already lost the skb

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 3, 2024
• High 7.8
  CVE-2024-27022

  fork: defer linking file vma until vma is fully initialized

  In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.8
  CVE-2024-36016

  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

  In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 29, 2024
• High 7.8
  CVE-2024-38562

  wifi: nl80211: Avoid address calculations via out of bounds array indexing

  In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexing Before request->channels[] can be used, request->n_channels must be set. Additionally, address calculations for memo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• High 7.8
  CVE-2024-40984

  ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."

  In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.5
  CVE-2024-38573

  cppc_cpufreq: Fix possible null pointer dereference

  In the Linux kernel, the following vulnerability has been resolved: cppc_cpufreq: Fix possible null pointer dereference cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• High 7.0
  CVE-2024-26930

  scsi: qla2xxx: Fix double free of the ha->vp_map pointer

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Medium 5.5
  CVE-2024-26991

  KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conver…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Medium 4.4
  CVE-2023-52884

  Input: cyapa - add missing input core locking to suspend/resume functions

  In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in other input drivers. This fixes the following wa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• Unscored —
  CVE-2024-26929 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-26947

  ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

  In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the sem…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-35895

  bpf, sockmap: Prevent lock inversion deadlock in map delete elem

  In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• Unscored —
  CVE-2024-36899

  gpiolib: cdev: Fix use after free in lineinfo_changed_notify

  In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 30, 2024
• Unscored —
  CVE-2024-38601

  ring-buffer: Fix a race between readers and resize checks

  In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix a race between readers and resize checks The reader code in rb_get_reader_page() swaps a new reader page into the ring buffer by doing cmpxchg on old->list.prev->next to poin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2024-38615

  cpufreq: exit() callback is optional

  In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional and shouldn't be called without checking a valid pointer first. Also, we must clear freq_table pointer even if the exit() …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2024-41071 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-42246

  net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket

  In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to lo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 7, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278245
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278248
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278252
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281677
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283894
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284549
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293348
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301543
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6997.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52439
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52439
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52439
• article
  https://lore.kernel.org/linux-cve-announce/2024022026-wobbling-jumbo-748e@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-52884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52884
• article
  https://lore.kernel.org/linux-cve-announce/2024062131-CVE-2023-52884-5b0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26739
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26739
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26739
• article
  https://lore.kernel.org/linux-cve-announce/2024040300-CVE-2024-26739-170e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26929
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26929
• report
  https://access.redhat.com/security/cve/CVE-2024-26930
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26930
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26930