RLSA-2022:1975 — Important: kernel-rt security and bug fix update

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

* kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

* kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

* kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

* kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

* kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

* kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

* kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

* kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

* kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

* kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

* kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

* kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

* kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

* kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

* kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

* kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

* kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

* kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

* hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

* kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

* kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

* kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

* kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

* kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

* kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

* kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

* kernel: information leak in the IPv6 implementation (CVE-2021-45485)

* kernel: information leak in the IPv4 implementation (CVE-2021-45486)

* hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

* hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

* kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

* kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

* kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

* kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Fixed packages 1

Release	Package	Fixed in
Rocky Linux · 8	kernel-rt	0:4.18.0-372.9.1.rt7.166.el8

Vulnerabilities 35

Medium 6.5

CVE-2022-0001 Public exploit

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 11, 2022
Medium 6.5

CVE-2022-0002

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 11, 2022
Medium 4.4

CVE-2021-4037

Kernel: security regression for cve-2018-13405

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a sc…

Linux Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Aug 24, 2022
Unscored —

CVE-2020-0404

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. Thi…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 17, 2020
Unscored —

CVE-2020-13974

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 9, 2020
Unscored —

CVE-2020-27820

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if rem…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 2, 2021
Unscored —

CVE-2021-0941

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Oct 25, 2021
Unscored —

CVE-2021-20322

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functiona…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 18, 2022
Unscored —

CVE-2021-26401

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

AMD AMD Processors linux-raspi2 linux-hwe Debian Ubuntu Alpine

Mar 11, 2022
Unscored —

CVE-2021-29154

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 8, 2021
Unscored —

CVE-2021-3612

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 9, 2021
Unscored —

CVE-2021-3669

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 26, 2022
Unscored —

CVE-2021-37159

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checkin…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jul 21, 2021
Unscored —

CVE-2021-3743

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 4, 2022
Unscored —

CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 4, 2022
Unscored —

CVE-2021-3752

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 16, 2022
Unscored —

CVE-2021-3759

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-3764

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a de…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-3772

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 2, 2022
Unscored —

CVE-2021-3773 Public exploit

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

Feb 16, 2022
Unscored —

CVE-2021-4002

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 3, 2022
Unscored —

CVE-2021-4083

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 18, 2022
Unscored —

CVE-2021-4157

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2021-41864

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tr…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 1, 2021
Unscored —

CVE-2021-4197

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 23, 2022
Unscored —

CVE-2021-4203

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2021-42739

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/fire…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 20, 2021
Unscored —

CVE-2021-43389

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 4, 2021
Unscored —

CVE-2021-43976

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 17, 2021
Unscored —

CVE-2021-44733 Public exploit

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 22, 2021
Unscored —

CVE-2021-45485 Public exploit

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 25, 2021
Unscored —

CVE-2021-45486

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 25, 2021
Unscored —

CVE-2022-0286

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 31, 2022
Unscored —

CVE-2022-0322

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2022-1011 Public exploit

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 18, 2022

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=1901726
report
https://bugzilla.redhat.com/show_bug.cgi?id=1903578
report
https://bugzilla.redhat.com/show_bug.cgi?id=1905749
report
https://bugzilla.redhat.com/show_bug.cgi?id=1919791
report
https://bugzilla.redhat.com/show_bug.cgi?id=1946684
report
https://bugzilla.redhat.com/show_bug.cgi?id=1951739
report
https://bugzilla.redhat.com/show_bug.cgi?id=1974079
report
https://bugzilla.redhat.com/show_bug.cgi?id=1985353
report
https://bugzilla.redhat.com/show_bug.cgi?id=1986473
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997467
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997961
report
https://bugzilla.redhat.com/show_bug.cgi?id=1999544
report
https://bugzilla.redhat.com/show_bug.cgi?id=1999675
report
https://bugzilla.redhat.com/show_bug.cgi?id=2000627
report
https://bugzilla.redhat.com/show_bug.cgi?id=2000694
report
https://bugzilla.redhat.com/show_bug.cgi?id=2004949
report
https://bugzilla.redhat.com/show_bug.cgi?id=2010463
report
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
report
https://bugzilla.redhat.com/show_bug.cgi?id=2014230
report
https://bugzilla.redhat.com/show_bug.cgi?id=2016169
report
https://bugzilla.redhat.com/show_bug.cgi?id=2018205
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025003
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025726
report
https://bugzilla.redhat.com/show_bug.cgi?id=2027239
report
https://bugzilla.redhat.com/show_bug.cgi?id=2029923
report
https://bugzilla.redhat.com/show_bug.cgi?id=2030747
report
https://bugzilla.redhat.com/show_bug.cgi?id=2034342
report
https://bugzilla.redhat.com/show_bug.cgi?id=2035652
report
https://bugzilla.redhat.com/show_bug.cgi?id=2036934
report
https://bugzilla.redhat.com/show_bug.cgi?id=2037019
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039911
report
https://bugzilla.redhat.com/show_bug.cgi?id=2039914
report
https://bugzilla.redhat.com/show_bug.cgi?id=2042822
report
https://bugzilla.redhat.com/show_bug.cgi?id=2061700
report
https://bugzilla.redhat.com/show_bug.cgi?id=2061712
report
https://bugzilla.redhat.com/show_bug.cgi?id=2061721
report
https://bugzilla.redhat.com/show_bug.cgi?id=2064855

Important: kernel-rt security and bug fix update

Summary

Fixed packages 1

Vulnerabilities 35

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…

Kernel: security regression for cve-2018-13405

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. Thi…

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if rem…

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functiona…

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc…

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checkin…

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a de…

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tr…

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found …

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race …

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/fire…

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash…

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…

References