Red Hat Security Advisory: kernel security update

Fixed packages 84

Vulnerabilities 11

• High 8.8
  CVE-2023-52522

  net: fix possible store tearing in neigh_periodic_work()

  In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• High 8.1
  CVE-2024-46858

  mptcp: pm: Fix uaf in __timer_delete_sync

  In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 27, 2024
• High 7.8
  CVE-2024-26640

  tcp: add sanity checks to rx zerocopy

  In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• High 7.8
  CVE-2024-26656

  drm/amdgpu: fix use-after-free bug

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 2, 2024
• High 7.8
  CVE-2024-26772

  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• High 7.8
  CVE-2024-26870

  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

  In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.8
  CVE-2024-42271

  net/iucv: fix use after free in iucv_sock_close()

  In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 17, 2024
• Unscored —
  CVE-2024-26906

  x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

  In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• Unscored —
  CVE-2024-31076

  genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

  In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• Unscored —
  CVE-2024-40931

  mptcp: ensure snd_una is properly initialized on connect

  In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkal…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41039

  firmware: cs_dsp: Fix overflow checking of wmfw header

  In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow checking of wmfw header Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tes…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272692
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275711
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293684
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300408
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315210
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9497.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52522
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52522
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52522
• article
  https://lore.kernel.org/linux-cve-announce/2024030253-CVE-2023-52522-6abd@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2024-26640
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26640
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26640
• article
  https://lore.kernel.org/linux-cve-announce/20240318102117.2839904-11-lee@kernel.org/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26656
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26656
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26656
• article
  https://lore.kernel.org/linux-cve-announce/2024040247-CVE-2024-26656-ffaa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26772
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26772
• article
  https://lore.kernel.org/linux-cve-announce/2024040308-CVE-2024-26772-5168@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26870
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26870
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26870
• article
  https://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26870-7aea@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26906
• article
  https://lore.kernel.org/linux-cve-announce/2024041746-CVE-2024-26906-bb35@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-31076
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-31076
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-31076