Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 20

• High 8.1
  CVE-2024-46858

  mptcp: pm: Fix uaf in __timer_delete_sync

  In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 27, 2024
• High 7.8
  CVE-2024-26656

  drm/amdgpu: fix use-after-free bug

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 2, 2024
• High 7.8
  CVE-2024-26772

  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• High 7.8
  CVE-2024-26870

  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

  In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.8
  CVE-2024-35814

  swiotlb: Fix double-allocation of slots due to broken alignment handling

  In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("sw…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 7.8
  CVE-2024-35950

  drm/client: Fully protect modes[] with dev->mode_config.mutex

  In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• High 7.8
  CVE-2024-38564

  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

  In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_cre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• High 7.8
  CVE-2024-40924

  drm/i915/dpt: Make DPT object unshrinkable

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.8
  CVE-2024-40956

  dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list

  In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.8
  CVE-2024-41060

  drm/radeon: check bo_va->bo is non-NULL before using it

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 7.5
  CVE-2024-41066

  ibmvnic: Add tx check to prevent skb leak

  In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consume…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• High 7.3
  CVE-2024-40901

  scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory

  In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Medium 5.5
  CVE-2024-26984

  nouveau: fix instmem race condition around ptr stores

  In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL point…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2023-52749

  spi: Fix null dereference on suspend

  In the Linux kernel, the following vulnerability has been resolved: spi: Fix null dereference on suspend A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2024
• Unscored —
  CVE-2024-26837

  net: bridge: switchdev: Skip MDB replays of deferred events on offload

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group membersh…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 17, 2024
• Unscored —
  CVE-2024-26906

  x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

  In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• Unscored —
  CVE-2024-31076

  genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

  In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• Unscored —
  CVE-2024-38596

  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writ…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2024-40988

  drm/radeon: fix UBSAN warning in kv_dpm.c

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41023

  sched/deadline: Fix task_struct reference leak

  In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently repor…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272692
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275711
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281942
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293684
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297508
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297540
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297706
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315210
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9546.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52749
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52749
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52749
• article
  https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2023-52749-684e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26656
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26656
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26656
• article
  https://lore.kernel.org/linux-cve-announce/2024040247-CVE-2024-26656-ffaa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26772
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26772
• article
  https://lore.kernel.org/linux-cve-announce/2024040308-CVE-2024-26772-5168@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26837
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26837
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26837
• article
  https://lore.kernel.org/linux-cve-announce/2024041715-CVE-2024-26837-753c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26870
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26870