Red Hat Product Errata RHBA-2024:5208 - Bug Fix Advisory
Issued:
2024-08-12
Updated:
2024-08-12

RHBA-2024:5208 - Bug Fix Advisory

Synopsis

updated rhpam-7/rhpam-kogito-builder-rhel8 container image

Type/Severity

Bug Fix Advisory

Topic

Updated rhpam-7/rhpam-kogito-builder-rhel8 container image is now available for RHEL-8 based Middleware Containers.

Description

The rhpam-7/rhpam-kogito-builder-rhel8 container image has been updated for RHEL-8 based Middleware Containers to address the following security advisory: RHSA-2024:5101 (see References)

Users of rhpam-7/rhpam-kogito-builder-rhel8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.

You can find images updated by this advisory in Red Hat Container Catalog (see References).

Solution

The RHEL-8 based Middleware Containers container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.

Affected Products

  • Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64

Fixes

  • BZ - 2263879 - CVE-2024-25739 kernel: crash due to a missing check for leb_size
  • BZ - 2265645 - CVE-2024-26586 kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption
  • BZ - 2265650 - CVE-2023-52451 kernel: powerpc: Fix access beyond end of drmem array
  • BZ - 2265797 - CVE-2023-52463 kernel: efivarfs: force RO when remounting if SetVariable is not supported
  • BZ - 2266341 - CVE-2023-52469 kernel: use-after-free in kv_parse_power_table
  • BZ - 2266347 - CVE-2023-52471 kernel: null pointer dereference issues in ice_ptp.c
  • BZ - 2266497 - CVE-2021-46939 kernel: tracing: Restructure trace_clock_global() to never block
  • BZ - 2266594 - CVE-2021-47018 kernel: ensure definition of the fixmap area is in a limit
  • BZ - 2267787 - CVE-2023-52530 kernel: wifi: mac80211: fix potential key use-after-free
  • BZ - 2268118 - CVE-2024-2201 hw: cpu: intel: Native Branch History Injection (BHI)
  • BZ - 2269070 - CVE-2023-52486 kernel: drm: Don't unref the same fb many times by mistake due to deadlock handling
  • BZ - 2269211 - CVE-2024-26614 kernel: tcp: make sure init the accept_queue's spinlocks once
  • BZ - 2270084 - CVE-2023-52619 kernel: pstore/ram: Fix crash when setting number of cpus to an odd number
  • BZ - 2270100 - CVE-2024-26640 kernel: tcp: add sanity checks to rx zerocopy
  • BZ - 2270700 - CVE-2023-28746 kernel: Local information disclosure on Intel(R) Atom(R) processors
  • BZ - 2271686 - CVE-2023-52623 kernel: SUNRPC: Fix a suspicious RCU usage warning
  • BZ - 2271688 - CVE-2023-52622 kernel: ext4: avoid online resizing failures due to oversized flex bg
  • BZ - 2272782 - CVE-2024-26660 kernel: drm/amd/display: Implement bounds check for stream encoder creation in DCN301
  • BZ - 2272795 - CVE-2024-26669 kernel: net/sched: flower: Fix chain template offload
  • BZ - 2273109 - CVE-2024-26686 kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
  • BZ - 2273117 - CVE-2024-26698 kernel: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
  • BZ - 2273174 - CVE-2024-26704 kernel: ext4: fix double-free of blocks due to wrong extents moved_len
  • BZ - 2273236 - CVE-2024-26773 kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  • BZ - 2273242 - CVE-2024-26772 kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  • BZ - 2273247 - CVE-2024-26733 kernel: arp: Prevent overflow in arp_req_get().
  • BZ - 2273268 - CVE-2024-26740 kernel: net/sched: act_mirred: use the backlog for mirred ingress
  • BZ - 2273427 - CVE-2024-26802 kernel: stmmac: Clear variable when destroying workqueue
  • BZ - 2273654 - CVE-2024-26810 kernel: vfio/pci: Lock external INTx masking ops
  • BZ - 2275565 - CVE-2024-26843 kernel: efi: runtime: Fix potential overflow of soft-reserved region size
  • BZ - 2275573 - CVE-2024-26840 kernel: cachefiles: fix memory leak in cachefiles_add_cache()
  • BZ - 2275580 - CVE-2024-26837 kernel: net: bridge: switchdev: Skip MDB replays of deferred events on offload
  • BZ - 2275694 - CVE-2024-26878 kernel: quota: Fix potential NULL pointer dereference
  • BZ - 2275711 - CVE-2024-26870 kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  • BZ - 2275744 - CVE-2024-26908 kernel: x86/xen: Add some null pointer checking to smp.c
  • BZ - 2275748 - CVE-2024-26853 kernel: igc: avoid returning frame twice in XDP_REDIRECT
  • BZ - 2275761 - CVE-2024-26852 kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  • BZ - 2275928 - CVE-2024-26921 kernel: inet: inet_defrag: prevent sk release while still in use
  • BZ - 2277166 - CVE-2024-26925 kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  • BZ - 2277238 - CVE-2024-36886 kernel: TIPC message reassembly use-after-free remote code execution vulnerability
  • BZ - 2277840 - CVE-2022-48632 kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
  • BZ - 2278176 - CVE-2024-26961 kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del
  • BZ - 2278178 - CVE-2024-26960 kernel: mm: swap: fix race between free_swap_and_cache() and swapoff()
  • BZ - 2278182 - CVE-2024-26958 kernel: nfs: fix UAF in direct writes
  • BZ - 2278218 - CVE-2024-26940 kernel: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
  • BZ - 2278256 - CVE-2024-27020 kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  • BZ - 2278258 - CVE-2024-27019 kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
  • BZ - 2278277 - CVE-2024-27011 kernel: netfilter: nf_tables: fix memleak in map from abort path
  • BZ - 2278279 - CVE-2024-27010 kernel: net/sched: Fix mirred deadlock on device recursion
  • BZ - 2278380 - CVE-2024-27065 kernel: netfilter: nf_tables: do not compare internal table flags on updates
  • BZ - 2278484 - CVE-2024-27025 kernel: nbd: null check for nla_nest_start
  • BZ - 2278515 - CVE-2023-52653 kernel: SUNRPC: fix a memleak in gss_import_v2_context
  • BZ - 2278535 - CVE-2024-27388 kernel: SUNRPC: fix some memleaks in gssx_dec_option_array
  • BZ - 2278539 - CVE-2023-52648 kernel: drm/vmwgfx: Unmap the surface before resetting it on a plane state
  • BZ - 2278989 - CVE-2024-21823 kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application
  • BZ - 2280440 - CVE-2024-27395 kernel: net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  • BZ - 2281054 - CVE-2024-35790 kernel: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
  • BZ - 2281133 - CVE-2024-27434 kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
  • BZ - 2281149 - CVE-2023-52658 kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"
  • BZ - 2281189 - CVE-2024-35824 kernel: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume
  • BZ - 2281190 - CVE-2024-35823 kernel: vt: fix unicode buffer corruption when deleting characters
  • BZ - 2281207 - CVE-2024-35814 kernel: swiotlb: Fix double-allocation of slots due to broken alignment handling
  • BZ - 2281215 - CVE-2024-35810 kernel: drm/vmwgfx: Fix the lifetime of the bo cursor memory
  • BZ - 2281221 - CVE-2024-35807 kernel: ext4: fix corruption during on-line resize
  • BZ - 2281235 - CVE-2024-35801 kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
  • BZ - 2281268 - CVE-2024-35847 kernel: irqchip/gic-v3-its: Prevent double free on error
  • BZ - 2281326 - CVE-2023-52679 kernel: of: Fix double free in of_parse_phandle_with_args_map
  • BZ - 2281360 - CVE-2023-52662 kernel: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
  • BZ - 2281510 - CVE-2024-35947 kernel: dyndbg: fix old BUG_ON in >control parser
  • BZ - 2281519 - CVE-2024-35930 kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  • BZ - 2281636 - CVE-2024-35912 kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks
  • BZ - 2281641 - CVE-2024-35910 kernel: tcp: properly terminate timers for kernel sockets
  • BZ - 2281664 - CVE-2024-35900 kernel: netfilter: nf_tables: reject new basechain after table flag update
  • BZ - 2281667 - CVE-2024-35899 kernel: netfilter: nf_tables: flush pending destroy work before exit_net release
  • BZ - 2281672 - CVE-2024-35897 kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion
  • BZ - 2281675 - CVE-2024-35896 kernel: netfilter: validate user input for expected length
  • BZ - 2281682 - CVE-2024-35893 kernel: net/sched: act_skbmod: prevent kernel-infoleak
  • BZ - 2281725 - CVE-2024-35876 kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
  • BZ - 2281752 - CVE-2024-35925 kernel: block: prevent division by zero in blk_rq_stat_sum()
  • BZ - 2281758 - CVE-2024-35924 kernel: usb: typec: ucsi: Limit read size on v1.2
  • BZ - 2281819 - CVE-2024-35938 kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB
  • BZ - 2281821 - CVE-2024-35937 kernel: wifi: cfg80211: check A-MSDU format more carefully
  • BZ - 2281833 - CVE-2024-35946 kernel: wifi: rtw89: fix null pointer access when abort scan
  • BZ - 2281938 - CVE-2024-35952 kernel: drm/ast: Fix soft lockup
  • BZ - 2281949 - CVE-2024-36005 kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path
  • BZ - 2281968 - CVE-2024-36000 kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge
  • BZ - 2281989 - CVE-2024-36006 kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  • BZ - 2282328 - CVE-2021-47408 kernel: netfilter: conntrack: serialize hash resizes and cleanups
  • BZ - 2282373 - CVE-2021-47373 kernel: irqchip/gic-v3-its: Fix potential VPE leak on error
  • BZ - 2282479 - CVE-2021-47304 kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized
  • BZ - 2282553 - CVE-2021-47257 kernel: net: ieee802154: fix null deref in parse dev addr
  • BZ - 2282615 - CVE-2023-52707 kernel: sched/psi: Fix use-after-free in ep_remove_wait_queue()
  • BZ - 2282623 - CVE-2023-52762 kernel: virtio-blk: fix implicit overflow on virtio_max_dma_size
  • BZ - 2282640 - CVE-2023-52730 kernel: mmc: sdio: fix possible resource leaks in some error paths
  • BZ - 2282642 - CVE-2023-52777 kernel: wifi: ath11k: fix gtk offload status event locking
  • BZ - 2282645 - CVE-2023-52832 kernel: wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  • BZ - 2282690 - CVE-2023-52775 kernel: net/smc: avoid data corruption caused by decline
  • BZ - 2282717 - CVE-2023-52847 kernel: media: bttv: fix use after free error due to btv->timeout timer
  • BZ - 2282719 - CVE-2023-52864 kernel: platform/x86: wmi: Fix opening of char device
  • BZ - 2282727 - CVE-2023-52803 kernel: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  • BZ - 2282742 - CVE-2023-52756 kernel: pwm: Fix double shift bug
  • BZ - 2282743 - CVE-2023-52811 kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
  • BZ - 2282744 - CVE-2023-52834 kernel: atl1c: Work around the DMA RX overflow issue
  • BZ - 2282759 - CVE-2023-52845 kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  • BZ - 2282763 - CVE-2023-52791 kernel: i2c: core: Run atomic i2c xfer when !preemptible
  • BZ - 2282766 - CVE-2023-52796 kernel: ipvlan: add ipvlan_route_v6_outbound() helper
  • BZ - 2282772 - CVE-2023-52784 kernel: bonding: stop the device in bond_setup_by_slave()
  • BZ - 2282780 - CVE-2023-52764 kernel: media: gspca: cpia1: shift-out-of-bounds in set_flicker
  • BZ - 2282887 - CVE-2021-47468 kernel: isdn: mISDN: Fix sleeping function called from invalid context
  • BZ - 2282896 - CVE-2021-47461 kernel: userfaultfd: fix a race between writeprotect and exit_mmap()
  • BZ - 2282923 - CVE-2021-47284 kernel: isdn: mISDN: netjet: Fix crash in nj_probe
  • BZ - 2282925 - CVE-2021-47491 kernel: mm: khugepaged: skip huge page collapse for special files
  • BZ - 2282950 - CVE-2024-36010 kernel: igb: Fix string truncation warnings in igb_set_fw_version
  • BZ - 2283401 - CVE-2021-47548 kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
  • BZ - 2283894 - CVE-2024-36016 kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  • BZ - 2284400 - CVE-2024-36020 kernel: i40e: fix vf may be used uninitialized in this function warning
  • BZ - 2284417 - CVE-2024-36017 kernel: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  • BZ - 2284421 - CVE-2024-36025 kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
  • BZ - 2284465 - CVE-2024-36945 kernel: net/smc: fix neighbour and rtable leak in smc_ib_find_route()
  • BZ - 2284474 - CVE-2024-36941 kernel: wifi: nl80211: don't free NULL coalescing rule
  • BZ - 2284477 - CVE-2024-36940 kernel: pinctrl: core: delete incorrect free in pinctrl_enable()
  • BZ - 2284488 - CVE-2024-36933 kernel: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  • BZ - 2284496 - CVE-2024-36929 kernel: net: core: reject skb_copy(_expand) for fraglist GSO skbs
  • BZ - 2284500 - CVE-2024-36927 kernel: ipv4: Fix uninit-value access in __ip_make_skb()
  • BZ - 2284513 - CVE-2024-36921 kernel: wifi: iwlwifi: mvm: guard against invalid STA ID on removal
  • BZ - 2284519 - CVE-2024-36917 kernel: block: fix overflow in blk_ioctl_discard()
  • BZ - 2284539 - CVE-2024-36905 kernel: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  • BZ - 2284541 - CVE-2024-36904 kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  • BZ - 2284556 - CVE-2024-36896 kernel: USB: core: Fix access violation during port device removal
  • BZ - 2284571 - CVE-2024-36889 kernel: mptcp: ensure snd_nxt is properly initialized on connect
  • BZ - 2284590 - CVE-2024-36954 kernel: tipc: fix a possible memleak in tipc_buf_append
  • BZ - 2284625 - CVE-2024-36950 kernel: firewire: ohci: mask bus reset interrupts between ISR and bottom half
  • BZ - 2290408 - CVE-2024-36960 kernel: drm/vmwgfx: Fix invalid reads in fence signaled events
  • BZ - 2292331 - CVE-2024-36971 kernel: net: CVE-2024-36971 kernel: UAF in network route management
  • BZ - 2293078 - CVE-2024-36978 kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  • BZ - 2293250 - CVE-2021-47579 kernel: ovl: fix warning in ovl_create_real()
  • BZ - 2293276 - CVE-2024-36979 kernel: net: bridge: mst: fix vlan use-after-free
  • BZ - 2293312 - CVE-2022-48747 kernel: block: Fix wrong offset in bio_truncate()
  • BZ - 2293316 - CVE-2022-48743 kernel: net: amd-xgbe: Fix skb data length underflow
  • BZ - 2293348 - CVE-2024-38615 kernel: cpufreq: exit() callback is optional
  • BZ - 2293367 - CVE-2024-38598 kernel: md: fix resync softlockup when bitmap size is less than array size
  • BZ - 2293371 - CVE-2024-38596 kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  • BZ - 2293383 - CVE-2022-48757 kernel: net: fix information leakage in /proc/net/ptype
  • BZ - 2293418 - CVE-2024-38575 kernel: wifi: brcmfmac: pcie: handle randbuf allocation failure
  • BZ - 2293420 - CVE-2024-38573 kernel: cppc_cpufreq: Fix possible null pointer dereference
  • BZ - 2293444 - CVE-2024-38555 kernel: net/mlx5: Discard command completions in internal error
  • BZ - 2293461 - CVE-2024-38538 kernel: net: bridge: xmit: make sure we have at least eth header len bytes
  • BZ - 2293653 - CVE-2024-36270 kernel: netfilter: tproxy: bail out if IP has been disabled on the device
  • BZ - 2293657 - CVE-2024-33621 kernel: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  • BZ - 2293684 - CVE-2024-31076 kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  • BZ - 2293687 - CVE-2024-36489 kernel: tls: fix missing memory barrier in tls_init
  • BZ - 2293700 - CVE-2024-38627 kernel: stm class: Fix a double free in stm_register_device()
  • BZ - 2293711 - CVE-2024-36286 kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  • BZ - 2294274 - CVE-2024-39276 kernel: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  • BZ - 2295914 - CVE-2024-39476 kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  • BZ - 2296067 - CVE-2024-39472 kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup
  • BZ - 2297056 - CVE-2024-39487 kernel: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
  • BZ - 2297474 - CVE-2024-39502 kernel: ionic: fix use after netif_napi_del()
  • BZ - 2297558 - CVE-2024-40974 kernel: powerpc/pseries: Enforce hcall result buffer validity and size
  • BZ - 2298108 - CVE-2021-47624 kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change

CVEs

ppc64le

rhpam-7/rhpam-kogito-builder-rhel8@sha256:9cabceef7b7eb4ffaf628812b371e9865c4aca22383b0faf5072fd3f752bbf25

x86_64

rhpam-7/rhpam-kogito-builder-rhel8@sha256:bcdfa2d0a4ad53559b8d19f543896b1a6e93a77c3b2bf95c1ce64ff563ce02ba

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.