Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-core | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-core | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-debuginfo | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-devel | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-kvm | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-modules | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debug-modules-extra | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debuginfo | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-debuginfo-common-x86_64 | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-devel | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-kvm | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-modules | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::nfv | kernel-rt-modules-extra | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-core | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-core | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-debuginfo | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-devel | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-modules | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debug-modules-extra | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debuginfo | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-debuginfo-common-x86_64 | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-devel | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-modules | 0:4.18.0-553.27.1.rt7.368.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::realtime | kernel-rt-modules-extra | 0:4.18.0-553.27.1.rt7.368.el8_10 |
Vulnerabilities 42
-
Critical 9.8
tipc: force a dst refcount before doing decryption
In the Linux kernel, the following vulnerability has been resolved: tipc: force a dst refcount before doing decryption As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before entering the xfrm type handlers"): "Crypto requests might return async…
-
Critical 9.3
dma-direct: Leak pages on dma_set_decrypted() failure
In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dma_set_decrypted() failure On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is retu…
-
Critical 9.1
tipc: Return non-zero value from tipc_udp_addr2str() on error
In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occ…
-
High 7.8
netfilter: nft_set_pipapo: do not free live element
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 10…
-
High 7.8
KVM: Always flush async #PF workqueue when vCPU is being destroyed
In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs…
-
High 7.8
netfilter: nft_set_pipapo: walk over current view on netlink dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it …
-
High 7.8
nouveau: lock the client object tree.
In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mapp…
-
High 7.8
netfilter: bridge: replace physindev with physinif in nf_bridge_info
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added to a neigh->arp_queue while waiting for an arp reply. Where original skb's skb->dev can be different t…
-
High 7.8
of: module: add buffer overflow check in of_modalias()
In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str…
-
High 7.8
netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage coll…
-
High 7.8
drm/i915/dpt: Make DPT object unshrinkable
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries…
-
High 7.8
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel i…
-
High 7.8
bpf: Fix overrunning reservations in ringbuf
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos i…
-
High 7.8
drm/i915/gt: Fix potential UAF by revoke of fence registers
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines:…
-
High 7.8
dev/parport: fix the array out-of-bounds risk
In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not o…
-
High 7.8
mlxsw: spectrum_acl_erp: Fix object nesting warning
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can con…
-
High 7.8
memcg: protect concurrent access to mem_cgroup_idr
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to f…
-
High 7.8
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth b…
-
High 7.5
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vml…
-
High 7.5
ibmvnic: Add tx check to prevent skb leak
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consume…
-
High 7.0
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() wi…
-
Medium 4.6
Race condition vulnerability in Linux kernel bluetooth in conn_info_{min,max}_age_set()
A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.
-
Medium 4.4
dmaengine: fix NULL pointer in channel unregistration function
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local i…
-
Medium 4.4
bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_s…
-
Unscored —
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create If there are failures then we must not leave the non-NULL pointers with the error value, otherwise `rpcrdma_ep_destroy` gets c…
-
Unscored —CVE-2022-48936 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
r8169: Fix possible ring buffer corruption on fragmented Tx packets.
In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into …
-
Unscored —
net/mlx5e: Fix netif state handling
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix netif state handling mlx5e_suspend cleans resources only if netif_device_present() returns true. However, mlx5e_resume changes the state of netif, via mlx5e_nic_enable, only if…
-
Unscored —
ipv6: prevent possible NULL deref in fib6_nh_init()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL deref in fib6_nh_init() syzbot reminds us that in6_dev_get() can return NULL. fib6_nh_init() ip6_validate_gw( &idev ) ip6_route_check_nh( idev ) *idev = in6_dev_ge…
-
Unscored —
netfilter: nf_tables: prefer nft_chain_validate
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It…
-
Unscored —
drm/amdgpu: avoid using null object of framebuffer
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object i…
-
Unscored —
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VAL…
-
Unscored —
gfs2: Fix NULL pointer dereference in gfs2_log_flush
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2_log_flush In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush lock to provide exclusion against gfs2_log_flush(). In gfs2_log_flush…
-
Unscored —
USB: serial: mos7840: fix crash on resume
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic re…
-
Unscored —
kobject_uevent: Fix OOB access within zap_modalias_env()
In the Linux kernel, the following vulnerability has been resolved: kobject_uevent: Fix OOB access within zap_modalias_env() zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not …
-
Unscored —
block: initialize integrity buffer to zero before writing it to media
In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…
-
Unscored —
padata: Fix possible divide-by-0 panic in padata_mt_helper()
In the Linux kernel, the following vulnerability has been resolved: padata: Fix possible divide-by-0 panic in padata_mt_helper() We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PR…
-
Unscored —
sctp: Fix null-ptr-deref in reuseport_add_sock().
In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO…
-
Unscored —
bonding: fix xfrm real_dev null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks ass…
-
Unscored —
bonding: fix null pointer deref in bond_ipsec_offload_ok
In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer.
-
Unscored —
netfilter: flowtable: initialise extack before use
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.
-
Unscored —
ELF: fix kernel.randomize_va_space double read
In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with un…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2266247
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2269183
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275750
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2277168
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278262
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278350
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278387
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281284
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281669
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281817
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293356
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293402
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293458
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293459
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297475
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297508
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297545
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297567
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297568
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2298109
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2298412
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300412
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300442
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300487
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300488
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300508
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300517
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2305446
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2307862
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2307865
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2307892
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2309852
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2309853
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2311715
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2315178
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2317601
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8870.json
-
report
https://access.redhat.com/security/cve/CVE-2022-48773