RHSA-2024:1404 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.

'Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (CVE-2021-43975)
• kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)
• kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)
• kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)
• kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)
• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)
• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)
• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
• kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Bug Fix(es):

• The kernel is still getting hung up even after converting kernfs_mutex to kernfs_rwsem with massive concurrent kernfs access (open & lookup) performed by kubelet/node_exporter threads. (JIRA:RHEL-17149)
• kernel: Rate limit overflow messages in r8152 in intr_callback (JIRA:RHEL-18810)
• kernel: tun: avoid double free in tun_free_netdev (JIRA:RHEL-18813)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (JIRA:RHEL-18850)
• kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19461)
• ipoib mcast lockup fix (JIRA:RHEL-19698)
• kernel: denial of service in tipc_conn_close (JIRA:RHEL-18824)
• Rhel-8.6 crash at qed_get_current_link+0x11 during tx_timeout recovery (JIRA:RHEL-20923)
• kernel: use-after-free in sch_qfq network scheduler (JIRA:RHEL-14402)
• RHEL8.6 - s390/qeth: NET2016 - fix use-after-free in HSCI (JIRA:RHEL-15849)
• RHEL8.6 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17883)
• kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18582)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (JIRA:RHEL-18799)
• kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (JIRA:RHEL-18814)
• kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-18998)
• dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19110)
• kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19327)
• kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19451)
• [RHEL8] I/O blocked during fio background with IO schedule switch, cpu offline/online, pci nvme rescan/reset (JIRA:RHEL-20231)
• kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20298)
• kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20697)
• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (JIRA:RHEL-21661)
• kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21784)
• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (JIRA:RHEL-22090)
• backport timerlat user-space support (JIRA:RHEL-20361)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64

Fixes

• BZ - 2024989 - CVE-2021-43975 kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
• BZ - 2073091 - CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
• BZ - 2133451 - CVE-2022-36402 kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c
• BZ - 2133452 - CVE-2022-38096 kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query
• BZ - 2133453 - CVE-2022-40133 kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context
• BZ - 2133455 - CVE-2022-38457 kernel: vmwgfx: use-after-free in vmw_cmd_res_check
• BZ - 2144379 - CVE-2022-41858 kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip
• BZ - 2148520 - CVE-2022-45887 kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c
• BZ - 2149024 - CVE-2022-3594 kernel: Rate limit overflow messages in r8152 in intr_callback
• BZ - 2151317 - CVE-2022-45869 kernel: KVM: x86/mmu: race condition in direct_page_fault()
• BZ - 2156322 - CVE-2022-4744 kernel: tun: avoid double free in tun_free_netdev
• BZ - 2161310 - CVE-2022-3545 kernel: nfp: use-after-free in area_cache_get()
• BZ - 2177371 - CVE-2023-1382 kernel: denial of service in tipc_conn_close
• BZ - 2181330 - CVE-2023-28772 kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow
• BZ - 2187813 - CVE-2023-2166 kernel: NULL pointer dereference in can_rcv_filter
• BZ - 2187931 - CVE-2023-2176 kernel: Slab-out-of-bound read in compare_netdev_and_ip
• BZ - 2188468 - CVE-2023-30456 kernel: KVM: nVMX: missing consistency checks for CR0 and CR4
• BZ - 2213139 - CVE-2023-31084 kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible
• BZ - 2218195 - CVE-2023-33951 kernel: vmwgfx: race condition leading to information disclosure vulnerability
• BZ - 2218212 - CVE-2023-33952 kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
• BZ - 2231800 - CVE-2023-40283 kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c
• BZ - 2244715 - CVE-2023-45862 kernel: drivers/usb/storage/ene_ub6250.c
• BZ - 2245514 - CVE-2023-4921 kernel: use-after-free in sch_qfq network scheduler
• BZ - 2245663 - CVE-2023-5633 kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
• BZ - 2252731 - CVE-2023-6931 kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size
• BZ - 2253611 - CVE-2023-6606 kernel: Out-Of-Bounds Read vulnerability in smbCalcSize
• BZ - 2253614 - CVE-2023-6610 kernel: OOB Access in smb2_dump_detail
• BZ - 2253908 - CVE-2024-0646 kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
• BZ - 2255139 - CVE-2023-6817 kernel: inactive elements in nft_pipapo_walk
• BZ - 2255283 - CVE-2023-6932 kernel: use-after-free in IPv4 IGMP
• BZ - 2256279 - CVE-2023-7192 kernel: refcount leak in ctnetlink_create_conntrack()
• BZ - 2258518 - CVE-2024-0565 kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client
• BZ - 2259866 - CVE-2023-51042 kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
• BZ - 2260005 - CVE-2023-51043 kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c
• BZ - 2262126 - CVE-2024-1086 kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function

CVEs

• CVE-2021-43975
• CVE-2022-3545
• CVE-2022-3594
• CVE-2022-4744
• CVE-2022-28388
• CVE-2022-36402
• CVE-2022-38096
• CVE-2022-38457
• CVE-2022-40133
• CVE-2022-41858
• CVE-2022-45869
• CVE-2022-45887
• CVE-2023-1382
• CVE-2023-2166
• CVE-2023-2176
• CVE-2023-4921
• CVE-2023-5633
• CVE-2023-6606
• CVE-2023-6610
• CVE-2023-6817
• CVE-2023-6931
• CVE-2023-6932
• CVE-2023-7192
• CVE-2023-28772
• CVE-2023-30456
• CVE-2023-31084
• CVE-2023-33951
• CVE-2023-33952
• CVE-2023-40283
• CVE-2023-45862
• CVE-2023-51042
• CVE-2023-51043
• CVE-2024-0565
• CVE-2024-0646
• CVE-2024-1086

References

• https://access.redhat.com/security/updates/classification/#important