RHSA-2024:9498 - Security Advisory

Topic

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
• kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
• kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)
• kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (CVE-2024-26772)
• kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
• kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)
• kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (CVE-2024-31076)
• kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931)
• kernel: firmware: cs_dsp: Fix overflow checking of wmfw header (CVE-2024-41039)
• kernel: net/iucv: fix use after free in iucv_sock_close() (CVE-2024-42271)
• kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64

Fixes

• BZ - 2267795 - CVE-2023-52522 kernel: net: fix possible store tearing in neigh_periodic_work()
• BZ - 2270100 - CVE-2024-26640 kernel: tcp: add sanity checks to rx zerocopy
• BZ - 2272692 - CVE-2024-26656 kernel: drm/amdgpu: use-after-free vulnerability
• BZ - 2273242 - CVE-2024-26772 kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
• BZ - 2275635 - CVE-2024-26906 kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
• BZ - 2275711 - CVE-2024-26870 kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
• BZ - 2293684 - CVE-2024-31076 kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
• BZ - 2297515 - CVE-2024-40931 kernel: mptcp: ensure snd_una is properly initialized on connect
• BZ - 2300408 - CVE-2024-41039 kernel: firmware: cs_dsp: Fix overflow checking of wmfw header
• BZ - 2315210 - CVE-2024-46858 kernel: mptcp: pm: Fix uaf in __timer_delete_sync

CVEs

• CVE-2023-52522
• CVE-2024-26640
• CVE-2024-26656
• CVE-2024-26772
• CVE-2024-26870
• CVE-2024-26906
• CVE-2024-31076
• CVE-2024-40931
• CVE-2024-41039
• CVE-2024-42271
• CVE-2024-46858

References

• https://access.redhat.com/security/updates/classification/#moderate