Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 17

• Critical 9.8
  CVE-2024-46695

  selinux,smack: don't bypass permissions check in inode_setsecctx hook

  In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesys…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 13, 2024
• Critical 9.8
  CVE-2024-50154

  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

  In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2024
• High 7.8
  CVE-2023-52679

  of: Fix double free in of_parse_phandle_with_args_map

  In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acq…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 7.8
  CVE-2024-26924

  netfilter: nft_set_pipapo: do not free live element

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 10…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2024
• High 7.8
  CVE-2024-27012

  netfilter: nf_tables: restore set elements when delete set fails

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: restore set elements when delete set fails From abort path, nft_mapelem_activate() needs to restore refcounters to the original state. Currently, it uses the set->ops->w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.8
  CVE-2024-27017

  netfilter: nft_set_pipapo: walk over current view on netlink dump

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.5
  CVE-2024-50256

  netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() I got a syzbot report without a repro [1] crashing in nf_send_reset6() I think the issue is that dev->hard_header_len is zer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 9, 2024
• High 7.3
  CVE-2024-50275

  arm64/sve: Discard stale CPU state when handling SVE traps

  In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task hav…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 19, 2024
• High 7.0
  CVE-2024-26960

  mm: swap: fix race between free_swap_and_cache() and swapoff()

  In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Medium 5.5
  CVE-2024-35824

  misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume

  In the Linux kernel, the following vulnerability has been resolved: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume When not configured for wakeup lis3lv02d_i2c_suspend() will call lis3lv02d_poweroff() even if the device has …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• Medium 5.5
  CVE-2024-50110

  xfrm: fix one more kernel-infoleak in algo dumping

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a3…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• Medium 5.5
  CVE-2024-50142

  xfrm: validate new SA's prefixlen using SA family when sel.family is unset

  In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm se…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2024
• Medium 4.4
  CVE-2024-23307

  Integer overflow in raid5_cache_count in Linux kernel

  Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 25, 2024
• Unscored —
  CVE-2024-27011

  netfilter: nf_tables: fix memleak in map from abort path

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak in map from abort path The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delet…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-35876 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  May 19, 2024
• Unscored —
  CVE-2024-36954

  tipc: fix a possible memleak in tipc_buf_append

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err pa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-53113

  mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

  In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated betwe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267705
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277168
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278262
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278275
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281189
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281725
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284590
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323930
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324315
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324889
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329924
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1658.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52679
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52679
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52679
• article
  https://lore.kernel.org/linux-cve-announce/2024051750-CVE-2023-52679-948f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-23307
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-23307
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-23307
• article
  https://bugzilla.openanolis.cn/show_bug.cgi?id=7975
• article
  https://lore.kernel.org/linux-raid/20240112071017.16313-1-2045gemini@gmail.com/#r
• article
  https://patchwork.kernel.org/project/linux-raid/patch/20240112071017.16313-1-2045gemini@gmail.com/
• report
  https://access.redhat.com/security/cve/CVE-2024-26924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26924
• article
  https://lore.kernel.org/linux-cve-announce/2024042420-CVE-2024-26924-4d1e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26960
• article
  https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26960-ad6b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-27011
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27011
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27011