Red Hat Security Advisory: kernel security update

Fixed packages 143

Vulnerabilities 3

• High 8.1
  CVE-2024-46858

  mptcp: pm: Fix uaf in __timer_delete_sync

  In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 27, 2024
• Unscored —
  CVE-2024-42283

  net: nexthop: Initialize all fields in dumped nexthops

  In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 17, 2024
• Unscored —
  CVE-2024-46824

  iommufd: Require drivers to supply the cache_invalidate_user ops

  In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this then iommufd will oops invalidation ioctls with something like: Unable to handle kernel NULL pointer …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 27, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305428
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315210
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9605.json
• report
  https://access.redhat.com/security/cve/CVE-2024-42283
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-42283
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-42283
• article
  https://lore.kernel.org/linux-cve-announce/2024081743-CVE-2024-42283-15a5@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-46824
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-46824
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-46824
• article
  https://lore.kernel.org/linux-cve-announce/2024092750-CVE-2024-46824-03d9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-46858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-46858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-46858
• article
  https://lore.kernel.org/linux-cve-announce/2024092744-CVE-2024-46858-dab6@gregkh/T