RHSA-2024:4831 - Security Advisory

Topic

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):

• kernel: vmwgfx: multiple flaws (CVE-2022-36402, CVE-2022-40133, CVE-2022-38457, CVE-2023-5633)
• kernel: nftables: (CVE-2024-26581)
• kernel: uio: (CVE-2023-52439)
• kernel: smb: (CVE-2023-52434)
• kernel: intel: (CVE-2023-52450)
• kernel: net: multiple flaws (CVE-2023-52578, CVE-2024-36978, CVE-2022-48743)
• kernel: Bluetooth: (CVE-2023-52518)
• kernel: netfilter: multiple flaws (CVE-2024-26668, CVE-2024-26808, CVE-2024-26925, CVE-2024-27020, CVE-2024-27019, CVE-2024-27016, CVE-2024-27065, CVE-2024-35899, CVE-2024-35897)
• kernel: hv_netvsc: (CVE-2024-26698)
• kernel: ext4: multiple flaws (CVE-2024-26704, CVE-2024-26773)
• kernel: net/sched: (CVE-2024-26739)
• kernel: vfio/pci: (CVE-2024-26810)
• kernel: dm: (CVE-2024-26880)
• kernel: af_unix: multiple flaws (CVE-2024-26923, CVE-2024-38596)
• kernel: scsi: multiple flaws (CVE-2024-26931, CVE-2024-26929, CVE-2023-52811, CVE-2024-36025, CVE-2024-36924, CVE-2024-36952)
• kernel: Squashfs: (CVE-2024-26982)
• kernel: KVM: (CVE-2024-35791)
• kernel: ipv6: (CVE-2024-27417)
• kernel: drm/client: (CVE-2024-35950)
• kernel: sched/psi: (CVE-2023-52707)
• kernel: can: (CVE-2021-47459)
• kernel: tcp: (CVE-2024-36904)
• kernel: tls: (CVE-2024-36489)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.2 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.2 x86_64

Fixes

• BZ - 2133451 - CVE-2022-36402 kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c
• BZ - 2133453 - CVE-2022-40133 kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context
• BZ - 2133455 - CVE-2022-38457 kernel: vmwgfx: use-after-free in vmw_cmd_res_check
• BZ - 2218195 - CVE-2023-33951 kernel: vmwgfx: race condition leading to information disclosure vulnerability
• BZ - 2218212 - CVE-2023-33952 kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
• BZ - 2245663 - CVE-2023-5633 kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
• BZ - 2262241 - CVE-2024-1151 kernel: stack overflow problem in Open vSwitch kernel module leading to DoS
• BZ - 2265185 - CVE-2024-26581 kernel: nftables: nft_set_rbtree skip end interval element from gc
• BZ - 2265271 - CVE-2023-52439 kernel: uio: Fix use-after-free in uio_open
• BZ - 2265285 - CVE-2023-52434 kernel: smb: client: fix potential OOBs in smb2_parse_contexts()
• BZ - 2265649 - CVE-2023-52450 kernel: intel: Fix NULL pointer dereference issue in upi_fill_topology()
• BZ - 2267758 - CVE-2023-52578 kernel: net: bridge: data races indata-races in br_handle_frame_finish()
• BZ - 2267799 - CVE-2023-52518 kernel: Bluetooth: hci_codec: Fix leaking content of local_codecs
• BZ - 2272797 - CVE-2024-26668 kernel: netfilter: nft_limit: reject configurations that cause integer overflow
• BZ - 2273117 - CVE-2024-26698 kernel: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
• BZ - 2273174 - CVE-2024-26704 kernel: ext4: fix double-free of blocks due to wrong extents moved_len
• BZ - 2273236 - CVE-2024-26773 kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
• BZ - 2273270 - CVE-2024-26739 kernel: net/sched: act_mirred: don't override retval if we already lost the skb
• BZ - 2273405 - CVE-2024-26808 kernel: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
• BZ - 2273654 - CVE-2024-26810 kernel: vfio/pci: Lock external INTx masking ops
• BZ - 2275690 - CVE-2024-26880 kernel: dm: call the resume method on internal suspend
• BZ - 2277166 - CVE-2024-26925 kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
• BZ - 2277171 - CVE-2024-26923 kernel: af_unix: Fix garbage collector racing against connect()
• BZ - 2278245 - CVE-2024-26931 kernel: scsi: qla2xxx: Fix command flush on cable pull
• BZ - 2278250 - CVE-2024-26929 kernel: scsi: qla2xxx: Fix double free of fcport
• BZ - 2278256 - CVE-2024-27020 kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
• BZ - 2278258 - CVE-2024-27019 kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
• BZ - 2278264 - CVE-2024-27016 kernel: netfilter: flowtable: validate pppoe header
• BZ - 2278337 - CVE-2024-26982 kernel: Squashfs: check the inode number is not the invalid value of zero
• BZ - 2278380 - CVE-2024-27065 kernel: netfilter: nf_tables: do not compare internal table flags on updates
• BZ - 2281052 - CVE-2024-35791 kernel: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
• BZ - 2281097 - CVE-2024-27417 kernel: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
• BZ - 2281667 - CVE-2024-35899 kernel: netfilter: nf_tables: flush pending destroy work before exit_net release
• BZ - 2281672 - CVE-2024-35897 kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion
• BZ - 2281942 - CVE-2024-35950 kernel: drm/client: Fully protect modes[] with dev->mode_config.mutex
• BZ - 2282615 - CVE-2023-52707 kernel: sched/psi: Fix use-after-free in ep_remove_wait_queue()
• BZ - 2282743 - CVE-2023-52811 kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
• BZ - 2282898 - CVE-2021-47459 kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
• BZ - 2284421 - CVE-2024-36025 kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
• BZ - 2284506 - CVE-2024-36924 kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
• BZ - 2284541 - CVE-2024-36904 kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
• BZ - 2284598 - CVE-2024-36952 kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• BZ - 2293078 - CVE-2024-36978 kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
• BZ - 2293316 - CVE-2022-48743 kernel: net: amd-xgbe: Fix skb data length underflow
• BZ - 2293371 - CVE-2024-38596 kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
• BZ - 2293687 - CVE-2024-36489 kernel: tls: fix missing memory barrier in tls_init

CVEs

• CVE-2021-47459
• CVE-2022-36402
• CVE-2022-38457
• CVE-2022-40133
• CVE-2022-48743
• CVE-2023-5633
• CVE-2023-33951
• CVE-2023-33952
• CVE-2023-52434
• CVE-2023-52439
• CVE-2023-52450
• CVE-2023-52518
• CVE-2023-52578
• CVE-2023-52707
• CVE-2023-52811
• CVE-2024-1151
• CVE-2024-26581
• CVE-2024-26668
• CVE-2024-26698
• CVE-2024-26704
• CVE-2024-26739
• CVE-2024-26773
• CVE-2024-26808
• CVE-2024-26810
• CVE-2024-26880
• CVE-2024-26923
• CVE-2024-26925
• CVE-2024-26929
• CVE-2024-26931
• CVE-2024-26982
• CVE-2024-27016
• CVE-2024-27019
• CVE-2024-27020
• CVE-2024-27065
• CVE-2024-27417
• CVE-2024-35791
• CVE-2024-35897
• CVE-2024-35899
• CVE-2024-35950
• CVE-2024-36025
• CVE-2024-36489
• CVE-2024-36904
• CVE-2024-36924
• CVE-2024-36952
• CVE-2024-36978
• CVE-2024-38596

References

• https://access.redhat.com/security/updates/classification/#important