Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.2635
kernel-rt security and bug fix update
10 May 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel-rt
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2023-1382 CVE-2023-1195 CVE-2023-0590
CVE-2023-0461 CVE-2023-0394 CVE-2022-47929
CVE-2022-43750 CVE-2022-42896 CVE-2022-42722
CVE-2022-42721 CVE-2022-42720 CVE-2022-42703
CVE-2022-41674 CVE-2022-39189 CVE-2022-39188
CVE-2022-33743 CVE-2022-28388 CVE-2022-21505
CVE-2022-20141 CVE-2022-4129 CVE-2022-4128
CVE-2022-3707 CVE-2022-3640 CVE-2022-3628
CVE-2022-3625 CVE-2022-3623 CVE-2022-3619
CVE-2022-3567 CVE-2022-3566 CVE-2022-3524
CVE-2022-3522 CVE-2022-3435 CVE-2022-3028
CVE-2022-2663 CVE-2022-2196 CVE-2022-1882
CVE-2022-1789 CVE-2022-1462 CVE-2021-33655
CVE-2021-26341
Original Bulletin:
https://access.redhat.com/errata/RHSA-2023:2148
Comment: CVSS (Max): 8.1 CVE-2022-42896 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: kernel-rt security and bug fix update
Advisory ID: RHSA-2023:2148-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2148
Issue date: 2023-05-09
CVE Names: CVE-2021-26341 CVE-2021-33655 CVE-2022-1462
CVE-2022-1789 CVE-2022-1882 CVE-2022-2196
CVE-2022-2663 CVE-2022-3028 CVE-2022-3435
CVE-2022-3522 CVE-2022-3524 CVE-2022-3566
CVE-2022-3567 CVE-2022-3619 CVE-2022-3623
CVE-2022-3625 CVE-2022-3628 CVE-2022-3640
CVE-2022-3707 CVE-2022-4128 CVE-2022-4129
CVE-2022-20141 CVE-2022-21505 CVE-2022-28388
CVE-2022-33743 CVE-2022-39188 CVE-2022-39189
CVE-2022-41674 CVE-2022-42703 CVE-2022-42720
CVE-2022-42721 CVE-2022-42722 CVE-2022-42896
CVE-2022-43750 CVE-2022-47929 CVE-2023-0394
CVE-2023-0461 CVE-2023-0590 CVE-2023-1195
CVE-2023-1382
=====================================================================
1. Summary:
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux NFV (v. 9) - x86_64
Red Hat Enterprise Linux RT (v. 9) - x86_64
3. Description:
The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* use-after-free in l2cap_connect and l2cap_le_connect_req in
net/bluetooth/l2cap_core.c (CVE-2022-42896)
* net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
* hw: cpu: AMD CPUs may transiently execute beyond unconditional direct
branch (CVE-2021-26341)
* malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory
(CVE-2021-33655)
* possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
* KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
* use-after-free in free_pipe_info() could lead to privilege escalation
(CVE-2022-1882)
* KVM: nVMX: missing IBPB when exiting from nested guest can lead to
Spectre v2 attacks (CVE-2022-2196)
* netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
* race condition in xfrm_probe_algs can lead to OOB read/write
(CVE-2022-3028)
* out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c
(CVE-2022-3435)
* race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
* memory leak in ipv6_renew_options() (CVE-2022-3524)
* data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
* data races around sk->sk_prot (CVE-2022-3567)
* memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c
(CVE-2022-3619)
* denial of service in follow_page_pte in mm/gup.c due to poisoned pte
entry (CVE-2022-3623)
* use-after-free after failed devlink reload in devlink_param_get
(CVE-2022-3625)
* USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
* use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c
(CVE-2022-3640)
* Double-free in split_2MB_gtt_entry when function
intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
* mptcp: NULL pointer dereference in subflow traversal at disconnect time
(CVE-2022-4128)
* l2tp: missing lock when clearing sk_user_data can lead to NULL pointer
dereference (CVE-2022-4129)
* igmp: use-after-free in ip_check_mc_rcu when opening and closing inet
sockets (CVE-2022-20141)
* lockdown bypass using IMA (CVE-2022-21505)
* double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
(CVE-2022-28388)
* network backend may cause Linux netfront to use freed SKBs (XSA-405)
(CVE-2022-33743)
* unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to
stale TLB entry (CVE-2022-39188)
* TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading
to guest malfunctioning (CVE-2022-39189)
* u8 overflow problem in cfg80211_update_notlisted_nontrans()
(CVE-2022-41674)
* use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
* use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
* BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c
(CVE-2022-42721)
* Denial of service in beacon protection for P2P-device (CVE-2022-42722)
* memory corruption in usbmon driver (CVE-2022-43750)
* NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
* NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
* use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
* use-after-free caused by invalid pointer hostname in fs/cifs/connect.c
(CVE-2023-1195)
* denial of service in tipc_conn_close (CVE-2023-1382)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.2 Release Notes linked from the References section.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2061703 - CVE-2021-26341 hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch
2073091 - CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
2078466 - CVE-2022-1462 kernel: possible race condition in drivers/tty/tty_buffers.c
2089701 - CVE-2022-1882 kernel: use-after-free in free_pipe_info() could lead to privilege escalation
2090723 - CVE-2022-1789 kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva
2106830 - CVE-2022-21505 kernel: lockdown bypass using IMA
2107924 - CVE-2022-33743 kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405)
2108691 - CVE-2021-33655 kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory
2114937 - CVE-2022-20141 kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets
2122228 - CVE-2022-3028 kernel: race condition in xfrm_probe_algs can lead to OOB read/write
2123056 - CVE-2022-2663 kernel: netfilter: nf_conntrack_irc message handling issue
2124788 - CVE-2022-39189 kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning
2130141 - CVE-2022-39188 kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
2133483 - CVE-2022-42703 kernel: use-after-free related to leaf anon_vma double reuse
2133490 - CVE-2022-3435 kernel: out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c
2134377 - CVE-2022-41674 kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans()
2134380 - CVE-2022-4128 kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time
2134451 - CVE-2022-42720 kernel: use-after-free in bss_ref_get in net/wireless/scan.c
2134506 - CVE-2022-42721 kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c
2134517 - CVE-2022-42722 kernel: Denial of service in beacon protection for P2P-device
2134528 - CVE-2022-4129 kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference
2137979 - CVE-2022-3707 kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed
2139610 - CVE-2022-3640 kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c
2143893 - CVE-2022-3566 kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt
2143943 - CVE-2022-3567 kernel: data races around sk->sk_prot
2144720 - CVE-2022-3625 kernel: use-after-free after failed devlink reload in devlink_param_get
2147364 - CVE-2022-42896 kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c
2150947 - CVE-2022-3524 kernel: memory leak in ipv6_renew_options()
2150960 - CVE-2022-3628 kernel: USB-accessible buffer overflow in brcmfmac
2150979 - CVE-2022-3522 kernel: race condition in hugetlb_no_page() in mm/hugetlb.c
2151270 - CVE-2022-43750 kernel: memory corruption in usbmon driver
2154171 - CVE-2023-1195 kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c
2154235 - CVE-2022-3619 kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c
2160023 - CVE-2022-2196 kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks
2162120 - CVE-2023-0394 kernel: NULL pointer dereference in rawv6_push_pending_frames
2165721 - CVE-2022-3623 kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry
2165741 - CVE-2023-0590 kernel: use-after-free due to race condition in qdisc_graft()
2168246 - CVE-2022-47929 kernel: NULL pointer dereference in traffic control subsystem
2176192 - CVE-2023-0461 kernel: net/ulp: use-after-free in listening ULP sockets
2177371 - CVE-2023-1382 kernel: denial of service in tipc_conn_close
6. Package List:
Red Hat Enterprise Linux NFV (v. 9):
Source:
kernel-rt-5.14.0-284.11.1.rt14.296.el9_2.src.rpm
x86_64:
kernel-rt-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-debuginfo-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-devel-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-kvm-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-modules-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-modules-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-modules-extra-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debuginfo-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-devel-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-kvm-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-modules-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-modules-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-modules-extra-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
Red Hat Enterprise Linux RT (v. 9):
Source:
kernel-rt-5.14.0-284.11.1.rt14.296.el9_2.src.rpm
x86_64:
kernel-rt-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-debuginfo-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-devel-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-modules-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-modules-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debug-modules-extra-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debuginfo-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-debuginfo-common-x86_64-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-devel-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-modules-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-modules-core-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
kernel-rt-modules-extra-5.14.0-284.11.1.rt14.296.el9_2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-26341
https://access.redhat.com/security/cve/CVE-2021-33655
https://access.redhat.com/security/cve/CVE-2022-1462
https://access.redhat.com/security/cve/CVE-2022-1789
https://access.redhat.com/security/cve/CVE-2022-1882
https://access.redhat.com/security/cve/CVE-2022-2196
https://access.redhat.com/security/cve/CVE-2022-2663
https://access.redhat.com/security/cve/CVE-2022-3028
https://access.redhat.com/security/cve/CVE-2022-3435
https://access.redhat.com/security/cve/CVE-2022-3522
https://access.redhat.com/security/cve/CVE-2022-3524
https://access.redhat.com/security/cve/CVE-2022-3566
https://access.redhat.com/security/cve/CVE-2022-3567
https://access.redhat.com/security/cve/CVE-2022-3619
https://access.redhat.com/security/cve/CVE-2022-3623
https://access.redhat.com/security/cve/CVE-2022-3625
https://access.redhat.com/security/cve/CVE-2022-3628
https://access.redhat.com/security/cve/CVE-2022-3640
https://access.redhat.com/security/cve/CVE-2022-3707
https://access.redhat.com/security/cve/CVE-2022-4128
https://access.redhat.com/security/cve/CVE-2022-4129
https://access.redhat.com/security/cve/CVE-2022-20141
https://access.redhat.com/security/cve/CVE-2022-21505
https://access.redhat.com/security/cve/CVE-2022-28388
https://access.redhat.com/security/cve/CVE-2022-33743
https://access.redhat.com/security/cve/CVE-2022-39188
https://access.redhat.com/security/cve/CVE-2022-39189
https://access.redhat.com/security/cve/CVE-2022-41674
https://access.redhat.com/security/cve/CVE-2022-42703
https://access.redhat.com/security/cve/CVE-2022-42720
https://access.redhat.com/security/cve/CVE-2022-42721
https://access.redhat.com/security/cve/CVE-2022-42722
https://access.redhat.com/security/cve/CVE-2022-42896
https://access.redhat.com/security/cve/CVE-2022-43750
https://access.redhat.com/security/cve/CVE-2022-47929
https://access.redhat.com/security/cve/CVE-2023-0394
https://access.redhat.com/security/cve/CVE-2023-0461
https://access.redhat.com/security/cve/CVE-2023-0590
https://access.redhat.com/security/cve/CVE-2023-1195
https://access.redhat.com/security/cve/CVE-2023-1382
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZFo0NtzjgjWX9erEAQhskQ//eAqMI93djEsADoo5zb3EO3xEGrb//Im2
ptPycHLLL6ZG+t/+1PiMk/e8LwhV2hrxz7nzc4xh8tNO4TRuF0WK/sR8Iv4y6/Fs
95X25NgEndOlHk7uUVgEdTYvZnpNh27XJwyEHDu6HV8suxY6gfbYHqV7zlkGBi43
zQA+sfEDXFVfvLug/RpaD0J7wXc0JyUoG4OratWV1E37zw9mNPSX1P0bFy4QoKXL
rhG1Xc+qSWK3kjnJjpeU8nIJGhL2oJDFVuICkiC+aEp7C//DE1TA7L7u3Z+7Tou/
BpPmjMyfXF/UQYZtJCrCRiTj/RsRIqaUSoy3/3MO8jxVMR6FIm/QTjY63JCGfj6A
OahLv77oKDJXuHQQ7JkHycKMOc+JfX/ZNtxtgn2gYFfpjPTY/klTJP8iM9KhnTuQ
2lF5jvYJihYhGio+cyl5Ad/XmzsHh7cTQR3XKtNa7p9/+QkAKt10LhbzxvebThFd
cZtLUsdph4wO6T+RrZ5XdwvOSox1C40mfOnwJO41M/9GXPHoxhmwrZYBWKE1PY0J
Jq9m+pYgKv+ioTW1FWloM22mu0PW/L5F3djzAVujShX0iRgfW2Aao3n+L8A22bYD
Q+5LbFsWZwpeK7zXgXocJlY7j667sT9UGqBwk4xMfAiS5A0p2Zo1rkIre2lvmF2D
JJU7NBGa9VU=
=YrUX
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZFse5skNZI30y1K9AQjdUxAAhc1qoEagFMxeeymCeJxcLH7NEz5KCnYl
VV6IVrfCbrnNKha04C7NXicTHxM2tJv32rFrqcvT3yMLj3p3iTy8+yyUMq31CaYA
uvrQDYKSqZNapqb5iz19/M4u0K6E+ZCD6UFhgpF5UXcr4ucS6JLckJXU9EwdkbiU
fT8dS1RXNblybihubUN9+/dKpiVAv3ANeSKTHc2B1urkYSUSQYw+VqV54K1pCUU+
ooE5FcDZ1q8b/NSpGMKXPQklZTcs0mr6NF7Xd3H3632v7I6K4lYmCqz9m2SDn9DV
oQchWtaZ5VF2uGBW8MZM4RjYokjIsPtji+cgTqKxReivWeZaYvjq22wuQOTNYrFd
eiTSdmabJn7qYhNclLML+4l7zTSxeQ+5e9BsKYbMmNtYUbqpir0PhJdmM5VK4jwq
Cc1bb65LK3vMoPq5AhBn1/eRsLpjOZ1AQvU5n8mycj1OIlT8cdfH4oUR7DUW07Gs
OawhVJT0GYNOvGnYR3A7bDUNTgxdyGTMxA+b7DQ9/kN11Zc5abNbvtDRdij9tBhE
ha6dEMwt3lRa+0YWcgXaTDVsMsUI2gbdjePhY14f6rmvNEUVbOsh/KfTgqxGfjZD
bdrOBeGUvYuLMj2v1x0ONuOKRaJ4M+Fe84VwyyMaDYobLLQS1FZeegsTrRfScvlU
x0rtf4ZIUu4=
=dSYF
-----END PGP SIGNATURE-----