Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201)
* kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
* kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
* kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)
* kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961)
* kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935)
* kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383)
* kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244)
* kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472)
* kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504)
* kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904)
* kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931)
* kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960)
* kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972)
* kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977)
* kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)
* kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (CVE-2024-40998)
* kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005)
* kernel: xfs: don't walk off the end of a directory data block (CVE-2024-41013)
* kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014)
* kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
* kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-427.42.1.el9_4 |
Vulnerabilities 22
-
High 7.8
tty: Fix out-of-bound vmalloc access in imageblit
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields…
-
High 7.8
tcp: add sanity checks to rx zerocopy
In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …
-
High 7.8
af_unix: Fix garbage collector racing against connect()
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…
-
High 7.5
mptcp: fix data re-injection from stale subflow
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…
-
High 7.3
xfs: fix log recovery buffer allocation for the legacy h_size fixup
In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values use…
-
High 7.1
xfs: add bounds checking to xlog_recover_process_data
In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create …
-
High 7.0
mac802154: fix llsec key resources release in mac802154_llsec_key_del
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end…
-
Medium 4.7
CVE-2024-2201
A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.
-
Unscored —
scsi: core: Fix unremoved procfs host directory regression
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unlo…
-
Unscored —
net/sched: taprio: extend minimum interval restriction to entire cycle too
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the t…
-
Unscored —
netfilter: nft_inner: validate mandatory meta and payload
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: validate mandatory meta and payload Check for mandatory netlink attributes in payload and meta expression when used embedded from the inner expression, otherwise NULL po…
-
Unscored —
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driv…
-
Unscored —
mptcp: ensure snd_una is properly initialized on connect
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkal…
-
Unscored —
ipv6: prevent possible NULL dereference in rt6_probe()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL dereference in rt6_probe() syzbot caught a NULL dereference in rt6_probe() [1] Bail out if __in6_dev_get() returns NULL. [1] Oops: general protection fault, probab…
-
Unscored —
ext4: do not create EA inode under buffer lock
In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allo…
-
Unscored —
wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery During chip recovery (e.g. chip reset), there is a possible situation that kernel worker reset_work is holding the lock and …
-
Unscored —
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …
-
Unscored —
ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() In the following concurrency we will access the uninitialized rs->lock: ext4_fill_super ext4_register_sysfs // sysf…
-
Unscored —
netpoll: Fix race condition in netpoll_owner_active
In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condition in netpoll: BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 …
-
Unscored —
xfs: don't walk off the end of a directory data block
In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a directory data block This adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry to make sure don't stray beyond valid memory region. Before patc…
-
Unscored —
block: initialize integrity buffer to zero before writing it to media
In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…
-
Unscored —
netfilter: flowtable: initialise extack before use
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268118
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2270100
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275604
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2277171
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278176
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278235
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282357
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293654
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2296067
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297476
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297488
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297515
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297544
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297556
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297561
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297579
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297582
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2297589
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300296
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2300297
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2311715