RHSA-2024:2394 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
• kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
• kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
• kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
• kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
• kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
• kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
• kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
• kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
• kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
• kernel: irdma: Improper access control (CVE-2023-25775)
• Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
• kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
• kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
• kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
• kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
• kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
• kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
• kernel: tls: race between async notify and socket close (CVE-2024-26583)
• kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
• kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
• kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
• kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
• kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
• kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
• kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
• kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Real Time 9 x86_64
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for Real Time for NFV 9 x86_64
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 9 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.4 x86_64

Fixes

• BZ - 1918601 - CVE-2020-26555 kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
• BZ - 2049700 - CVE-2022-0480 kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion
• BZ - 2133452 - CVE-2022-38096 kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query
• BZ - 2151959 - CVE-2022-45934 kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c
• BZ - 2177759 - CVE-2023-28464 Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
• BZ - 2185519 - CVE-2023-28866 kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c
• BZ - 2188102 - active-backup bond configured with an 802.3ad bond as a slave has incorrect speed/duplex information
• BZ - 2210024 - [RHEL9] st driver unit attention behavior over iSCSI
• BZ - 2213132 - CVE-2023-31083 kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl
• BZ - 2218332 - CVE-2023-39198 kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create()
• BZ - 2219359 - CVE-2023-6176 kernel: local dos vulnerability in scatterwalk_copychunks
• BZ - 2221039 - CVE-2023-37453 kernel: usb: out-of-bounds read in read_descriptors
• BZ - 2221463 - CVE-2023-3567 kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
• BZ - 2221702 - CVE-2023-4133 kernel: cxgb4: use-after-free in ch_flower_stats_cb()
• BZ - 2226777 - CVE-2023-39189 kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
• BZ - 2226787 - CVE-2023-39193 kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
• BZ - 2226788 - CVE-2023-39194 kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
• BZ - 2231410 - CVE-2023-25775 kernel: irdma: Improper access control
• BZ - 2239845 - CVE-2023-42754 kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach()
• BZ - 2239848 - CVE-2023-42756 kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP
• BZ - 2244720 - CVE-2023-45863 kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write
• BZ - 2246980 - CVE-2023-46862 kernel: NULL pointer dereference vulnerability in io_uring_show_fdinfo
• BZ - 2250043 - CVE-2023-6121 kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get
• BZ - 2252731 - CVE-2023-6931 kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size
• BZ - 2253034 - CVE-2023-6531 kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF
• BZ - 2253632 - CVE-2023-6622 kernel: null pointer dereference vulnerability in nft_dynset_init()
• BZ - 2254961 - CVE-2023-24023 kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses
• BZ - 2254982 - CVE-2023-6915 kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c
• BZ - 2255283 - CVE-2023-6932 kernel: use-after-free in IPv4 IGMP
• BZ - 2255498 - CVE-2023-6546 kernel: GSM multiplexing race condition leads to privilege escalation
• BZ - 2256490 - CVE-2024-0841 kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function
• BZ - 2256822 - CVE-2023-51779 kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg
• BZ - 2257682 - CVE-2023-51780 kernel: use-after-free in net/atm/ioctl.c
• BZ - 2258013 - CVE-2023-6040 kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable()
• BZ - 2258518 - CVE-2024-0565 kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client
• BZ - 2260005 - CVE-2023-51043 kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c
• BZ - 2262126 - CVE-2024-1086 kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function
• BZ - 2262127 - CVE-2024-1085 kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function
• BZ - 2265285 - CVE-2023-52434 kernel: smb: client: fix potential OOBs in smb2_parse_contexts()
• BZ - 2265517 - CVE-2024-26585 kernel: tls: race between tx work scheduling and socket close
• BZ - 2265518 - CVE-2024-26582 kernel: tls: use-after-free with partial reads and async decrypt
• BZ - 2265519 - CVE-2024-26584 kernel: tls: handle backlogging of crypto requests
• BZ - 2265520 - CVE-2024-26583 kernel: tls: race between async notify and socket close
• BZ - 2265645 - CVE-2024-26586 kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption
• BZ - 2265646 - CVE-2024-26593 kernel: i2c: i801: Fix block process call transactions
• BZ - 2265653 - CVE-2023-52448 kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
• BZ - 2267041 - CVE-2023-52476 kernel: perf/x86/lbr: Filter vsyscall addresses
• BZ - 2267695 - CVE-2024-26602 kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier
• BZ - 2267750 - CVE-2023-52574 kernel: team: NULL pointer dereference when team device type is changed
• BZ - 2267758 - CVE-2023-52578 kernel: net: bridge: data races indata-races in br_handle_frame_finish()
• BZ - 2267760 - CVE-2023-52580 kernel: net/core: kernel crash in ETH_P_1588 flow dissector
• BZ - 2267761 - CVE-2023-52581 kernel: netfilter: nf_tables: memory leak when more than 255 elements expired
• BZ - 2267788 - CVE-2023-52529 kernel: HID: sony: Fix a potential memory leak in sony_probe()
• BZ - 2267795 - CVE-2023-52522 kernel: net: fix possible store tearing in neigh_periodic_work()
• BZ - 2269189 - CVE-2023-52489 kernel: mm/sparsemem: fix race in accessing memory_section->usage
• BZ - 2269217 - CVE-2024-26609 kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters
• BZ - 2270080 - CVE-2023-52610 kernel: net/sched: act_ct: fix skb leak and crash on ooo frags
• BZ - 2270118 - CVE-2024-26633 kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
• BZ - 2270883 - CVE-2023-52620 kernel: netfilter: nf_tables: disallow timeout for anonymous sets
• RHEL-2376 - Backport compression related spec file changes into cs9/main
• RHEL-3923 - Missing extack in case of failure adding or removing an IPv6 address
• RHEL-2466 - [RHEL9] Corruption of slab_caches on cache shutdown with non-freed objects
• RHEL-5228 - [RHEL9.4] Backport upstream RCU commits up to v6.4 with additional fixes
• RHEL-2421 - Rebase arm core to upstream v6.6
• RHEL-7936 - Feature request: support for NFS with TLS
• RHEL-2907 - [rhel-9 wireless] Wireless core and drivers rebase to v6.6
• RHEL-6012 - Missing netlink event for removed route with src attribute
• RHEL-9127 - Backport kernel audit enhancements and fixes up to upstream v6.6
• RHEL-17986 - [RHEL9][CPU-Model][s390x] cpu modell gen16a/gen16 is not working as expected on z16 machines
• RHEL-19081 - [regression] BUG: KASAN: use-after-free in __lock_acquire+0x16d6/0x18b0
• RHEL-16024 - crash due to invalid cred->group_info address in cred_fscmp on 5.14.0-378.el9
• RHEL-5226 - [RHEL9.4] Update locking code to upstream v6.4 with additional fixes
• RHEL-15897 - Linux kernel panic=1 option hangs under qemu
• RHEL-15937 - Backport non-KVM parts of TDX host support

CVEs

• CVE-2020-26555
• CVE-2022-0480
• CVE-2022-38096
• CVE-2022-45934
• CVE-2022-48947
• CVE-2023-3567
• CVE-2023-4133
• CVE-2023-6040
• CVE-2023-6121
• CVE-2023-6176
• CVE-2023-6531
• CVE-2023-6546
• CVE-2023-6622
• CVE-2023-6915
• CVE-2023-6931
• CVE-2023-6932
• CVE-2023-24023
• CVE-2023-25775
• CVE-2023-28464
• CVE-2023-28866
• CVE-2023-31083
• CVE-2023-37453
• CVE-2023-39189
• CVE-2023-39193
• CVE-2023-39194
• CVE-2023-39198
• CVE-2023-42754
• CVE-2023-42756
• CVE-2023-45863
• CVE-2023-46862
• CVE-2023-51043
• CVE-2023-51779
• CVE-2023-51780
• CVE-2023-52434
• CVE-2023-52448
• CVE-2023-52450
• CVE-2023-52476
• CVE-2023-52489
• CVE-2023-52522
• CVE-2023-52529
• CVE-2023-52574
• CVE-2023-52578
• CVE-2023-52580
• CVE-2023-52581
• CVE-2023-52597
• CVE-2023-52610
• CVE-2023-52620
• CVE-2024-0565
• CVE-2024-0841
• CVE-2024-1085
• CVE-2024-1086
• CVE-2024-25744
• CVE-2024-26582
• CVE-2024-26583
• CVE-2024-26584
• CVE-2024-26585
• CVE-2024-26586
• CVE-2024-26593
• CVE-2024-26602
• CVE-2024-26609
• CVE-2024-26633
• CVE-2024-26671

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index