RHSA-2024:3138 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64

Fixes

• BZ - 1731000 - CVE-2019-13631 kernel: OOB writes in parse_hid_report_descriptor in drivers/input/tablet/gtco.c
• BZ - 1746732 - CVE-2019-15505 kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c
• BZ - 1888726 - CVE-2020-25656 kernel: use-after-free in read in vt_do_kdgkb_ioctl
• BZ - 1930388 - [RHEL8] st driver unit attention behavior over iSCSI
• BZ - 1999589 - CVE-2021-3753 kernel: a race out-of-bound read in vt
• BZ - 2039178 - CVE-2021-4204 kernel: improper input validation may lead to privilege escalation
• BZ - 2043520 - CVE-2022-23222 kernel: local privileges escalation in kernel/bpf/verifier.c
• BZ - 2044578 - CVE-2022-0500 kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges
• BZ - 2150953 - CVE-2022-3565 kernel: use-after-free in l1oip timer handlers
• BZ - 2151959 - CVE-2022-45934 kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c
• BZ - 2177759 - CVE-2023-28464 Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
• BZ - 2179892 - CVE-2023-1513 kernel: KVM: information leak in KVM_GET_DEBUGREGS ioctl on 32-bit systems
• BZ - 2213132 - CVE-2023-31083 kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl
• BZ - 2218332 - CVE-2023-39198 kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create()
• BZ - 2219359 - CVE-2023-6176 kernel: local dos vulnerability in scatterwalk_copychunks
• BZ - 2221039 - CVE-2023-37453 kernel: usb: out-of-bounds read in read_descriptors
• BZ - 2221463 - CVE-2023-3567 kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
• BZ - 2221702 - CVE-2023-4133 kernel: cxgb4: use-after-free in ch_flower_stats_cb()
• BZ - 2226777 - CVE-2023-39189 kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
• BZ - 2226784 - CVE-2023-39192 kernel: netfilter: xtables out-of-bounds read in u32_match_it()
• BZ - 2226787 - CVE-2023-39193 kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
• BZ - 2226788 - CVE-2023-39194 kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
• BZ - 2230042 - CVE-2023-38409 kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment
• BZ - 2231130 - Decoding filenames longer than 255 characters causes READDIR loop
• BZ - 2231410 - CVE-2023-25775 kernel: irdma: Improper access control
• BZ - 2235306 - CVE-2023-4244 kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction
• BZ - 2239845 - CVE-2023-42754 kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach()
• BZ - 2239847 - CVE-2023-42755 kernel: rsvp: out-of-bounds read in rsvp_classify()
• BZ - 2244720 - CVE-2023-45863 kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write
• BZ - 2250043 - CVE-2023-6121 kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get
• BZ - 2253632 - CVE-2023-6622 kernel: null pointer dereference vulnerability in nft_dynset_init()
• BZ - 2254961 - CVE-2023-24023 kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses
• BZ - 2254982 - CVE-2023-6915 kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c
• BZ - 2255283 - CVE-2023-6932 kernel: use-after-free in IPv4 IGMP
• BZ - 2256490 - CVE-2024-0841 kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function
• BZ - 2256822 - CVE-2023-51779 kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg
• BZ - 2257682 - CVE-2023-51780 kernel: use-after-free in net/atm/ioctl.c
• BZ - 2257979 - CVE-2023-52340 kernel: ICMPv6 ?Packet Too Big? packets force a DoS of the Linux kernel by forcing 100% CPU
• BZ - 2265285 - CVE-2023-52434 kernel: smb: client: fix potential OOBs in smb2_parse_contexts()
• BZ - 2265653 - CVE-2023-52448 kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
• BZ - 2267695 - CVE-2024-26602 kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier
• BZ - 2267750 - CVE-2023-52574 kernel: team: NULL pointer dereference when team device type is changed
• BZ - 2267760 - CVE-2023-52580 kernel: net/core: kernel crash in ETH_P_1588 flow dissector
• BZ - 2267761 - CVE-2023-52581 kernel: netfilter: nf_tables: memory leak when more than 255 elements expired
• BZ - 2269189 - CVE-2023-52489 kernel: mm/sparsemem: fix race in accessing memory_section->usage
• BZ - 2269217 - CVE-2024-26609 kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters
• BZ - 2270836 - CVE-2024-25742 CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit
• BZ - 2270883 - CVE-2023-52620 kernel: netfilter: nf_tables: disallow timeout for anonymous sets
• BZ - 2272811 - CVE-2024-26671 kernel: blk-mq: fix IO hang from sbitmap wakeup race
• RHEL-2527 - Make NOHZ play nice with cfs bandwidth in 8.10
• RHEL-2524 - Scheduler updates for 8.10
• RHEL-15148 - kernel crash when one process reads from /proc/fs/nfsd/clients at the same time as nfsd processes an unmount
• RHEL-15311 - Backport target driver fixes
• RHEL-6030 - backport "net: virtio_net_hdr_to_skb: count transport header in UFO"
• RHEL-9128 - Backport kernel audit enhancements and fixes up to upstream v6.6
• RHEL-7994 - NFSv4.1 client incorrectly sets up trunked connection when MDS=DS

CVEs

• CVE-2019-13631
• CVE-2019-15505
• CVE-2020-25656
• CVE-2021-3753
• CVE-2021-4204
• CVE-2022-0500
• CVE-2022-3565
• CVE-2022-23222
• CVE-2022-45934
• CVE-2022-48947
• CVE-2022-49081
• CVE-2022-49700
• CVE-2022-49759
• CVE-2022-49885
• CVE-2023-1513
• CVE-2023-3567
• CVE-2023-4133
• CVE-2023-4244
• CVE-2023-6121
• CVE-2023-6176
• CVE-2023-6622
• CVE-2023-6915
• CVE-2023-6932
• CVE-2023-24023
• CVE-2023-25775
• CVE-2023-28464
• CVE-2023-31083
• CVE-2023-37453
• CVE-2023-38409
• CVE-2023-39189
• CVE-2023-39192
• CVE-2023-39193
• CVE-2023-39194
• CVE-2023-39198
• CVE-2023-42754
• CVE-2023-42755
• CVE-2023-45863
• CVE-2023-51779
• CVE-2023-51780
• CVE-2023-52340
• CVE-2023-52434
• CVE-2023-52448
• CVE-2023-52489
• CVE-2023-52574
• CVE-2023-52580
• CVE-2023-52581
• CVE-2023-52597
• CVE-2023-52620
• CVE-2023-52973
• CVE-2023-53070
• CVE-2024-0841
• CVE-2024-25742
• CVE-2024-25743
• CVE-2024-26602
• CVE-2024-26609
• CVE-2024-26671
• CVE-2024-26830

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index