RHSA-2024:0575

Vulnerability from csaf_redhat - Published: 2024-01-30 13:28 - Updated: 2026-11-02 01:24
Summary
Red Hat Security Advisory: kernel security and bug fix update
Severity
Important
Notes
Topic: An update for kernel is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe (CVE-2023-2163) * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead (CVE-2023-3611) * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812) * kernel: use after free in unix_stream_sendpage (CVE-2023-4622) * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623) * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178) * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436) * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871) * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094) * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458) * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073) * kernel: hid: Use After Free in asus_remove() (CVE-2023-1079) * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838) * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162) * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567) * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() (CVE-2023-3772) * kernel: smsusb: use-after-free caused by do_submit_urb() (CVE-2023-4132) * kernel: A heap out-of-bounds write (CVE-2023-5717) * kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion (CVE-2023-23455) * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545) * kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (CVE-2023-28328) * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() (CVE-2023-33203) * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() (CVE-2023-35823) * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() (CVE-2023-35824) * kernel: r592: race condition leading to use-after-free in r592_remove() (CVE-2023-35825) * kernel: SEV-ES local priv escalation (CVE-2023-46813) * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075) * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855) * kernel: Use after free bug in r592_remove (CVE-2023-3141) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [RHEL 8.9] Proactively backport locking fixes from upstream (BZ#2235393)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2022-49995

In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdi_writeback. Fix this by checking if the bdi_writeback is alive, similar to when scheduling writeback work. Since this requires wb->work_lock, and wb_inode_writeback_end() may get called from interrupt, switch wb->work_lock to an irqsafe lock.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Product Identifier Version Remediation
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-0:4.18.0-477.43.1.el8_8.src —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-abi-stablelists-0:4.18.0-477.43.1.el8_8.noarch —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-core-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-core-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-core-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-core-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-core-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-core-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-core-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-core-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-devel-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-devel-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-devel-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-devel-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-extra-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-extra-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-extra-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debug-modules-extra-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-common-aarch64-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-common-s390x-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-debuginfo-common-x86_64-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-devel-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-devel-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-devel-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-devel-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-doc-0:4.18.0-477.43.1.el8_8.noarch —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-extra-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-extra-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-extra-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-modules-extra-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-libs-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-libs-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-tools-libs-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-zfcpdump-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-zfcpdump-core-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-zfcpdump-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-zfcpdump-devel-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-zfcpdump-modules-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:kernel-zfcpdump-modules-extra-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.s390x —
Vendor Fix fix
Unresolved product id: BaseOS-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:bpftool-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debug-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debuginfo-common-aarch64-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-debuginfo-common-x86_64-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-tools-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-tools-libs-devel-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-tools-libs-devel-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:kernel-tools-libs-devel-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:perf-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.aarch64 —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.ppc64le —
Vendor Fix fix
Unresolved product id: CRB-8.8.0.Z.EUS:python3-perf-debuginfo-0:4.18.0-477.43.1.el8_8.x86_64 —
Vendor Fix fix
Threats
Impact Moderate
CVE-2023-0458

A vulnerabilty was found in Linux Kernel, where a speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-1073

A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.

6.6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-1075

A memory leak flaw was found in the Linux kernel's TLS protocol. This issue could allow a local user unauthorized access to some memory.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-843 - Access of Resource Using Incompatible Type
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Low
CVE-2023-1079

A use-after-free flaw was found in asus_kbd_backlight_set in drivers/hid/hid-asus.c in the Linux Kernel. This issue could allow an attacker to crash the system when plugging in or disconnecting a malicious USB device, which may lead to a kernel information leak problem.

6.8 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-1838

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in the virtio network subcomponent in the Linux kernel due to a double fget. This issue could allow a local attacker to crash the system, and could lead to a kernel information leak problem.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-1855

A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Low
CVE-2023-2162

A use-after-free flaw was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in the SCSI sub-component in the Linux Kernel. This issue could allow an attacker to leak kernel internal information.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-2163

An incorrect verifier pruning flaw was found in BPF in the Linux Kernel that may lead to unsafe code paths incorrectly marked as safe, resulting in arbitrary read/writes in kernel memory, lateral privilege escalation, and container escape.

8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-682 - Incorrect Calculation
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-3141

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This issue may allow a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Low
CVE-2023-3567

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-3611

An out-of-bounds memory write flaw was found in qfq_change_agg in net/sched/sch_qfq.c in the Traffic Control (QoS) subsystem in the Linux kernel. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-3772

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-3812

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-4132

A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-4622

A use-after-free flaw was found in the Linux kernel's af_unix component that allows local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. This issue leads to a race condition where the unix_stream_sendpage() function could access a skb that is being released by garbage collection, resulting in a use-after-free issue.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-4623

A use-after-free flaw was found in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component that can be exploited to achieve local privilege escalation. If a class with a link-sharing curve, for example, with the HFSC_FSC flag set, has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free issue.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-5178

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-5717

A flaw was found in the Linux kernel's Performance Events system component. A condition can be triggered that allows data to be written past the end or before the beginning of the intended memory buffer. This issue may lead to a system crash, code execution, or local privilege escalation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-23455

A denial of service flaw was found in atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel. This issue may allow a local attacker to cause a denial of service due to type confusion. Non-negative numbers could indicate a TC_ACT_SHOT condition rather than valid classification results.

4.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
CWE-843 - Access of Resource Using Incompatible Type
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-26545

A double-free flaw was found in the Linux kernel when the MPLS implementation handled sysctl allocation failures. This issue could allow a local user to cause a denial of service or possibly execute arbitrary code.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-415 - Double Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-28328

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-31436

An out-of-bounds memory access flaw was found in the Linux kernel’s traffic control (QoS) subsystem in how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-33203

A race condition vulnerability was found in the Linux kernel's Qualcomm EMAC Gigabit Ethernet Controller when the user physically removes the device before cleanup in the emac_remove function. This flaw can eventually result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

6.4 (Medium)
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-459 - Incomplete Cleanup
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-35823

A race condition was found in the Linux kernel's saa7134 device driver. This occurs when removing the module before cleanup in the saa7134_finidev function which can result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-663 - Use of a Non-reentrant Function in a Concurrent Context
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-35824

A race condition was found in the Linux kernel's dm1105 device driver when removing the module before cleanup in the dm1105_remove function. This can result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-35825

A race condition was found in the Linux kernel's r592 device driver, when removing the module before cleanup in the r592_remove function. This can result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-366 - Race Condition within a Thread
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-45871

A flaw was found in igb_configure_rx_ring in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel. An overflow of the contents from a packet that is too large will overflow into the kernel's ring buffer, leading to a system integrity issue.

7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Important
CVE-2023-46813

A buffer overflow and null pointer dereference flaw was found in the Linux kernel's Secure Encrypted Virtualization (SEV) implementation for AMD functionality. This issue occurs when a user in SEV guest VM accesses MMIO registers, which could allow a local user to crash the system or escalate their privileges on the system.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269 - Improper Privilege Management
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-52973

In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data pointer load must be done at the top of while loop in vcs_read() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537 CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:350) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_read (drivers/tty/vt/vc_screen.c:415) vfs_read (fs/read_write.c:468 fs/read_write.c:450) ... </TASK> Allocated by task 1191: ... kmalloc_trace (mm/slab_common.c:1069) vc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720 drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108) con_install (drivers/tty/vt/vt.c:3383) tty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413 drivers/tty/tty_io.c:1390) tty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:883) vfs_open (fs/open.c:1014) ... Freed by task 1548: ... kfree (mm/slab_common.c:1021) vc_port_destruct (drivers/tty/vt/vt.c:1094) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2776) ... The buggy address belongs to the object at ffff888113747800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of 1024-byte region [ffff888113747800, ffff888113747c00) The buggy address belongs to the physical page: page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113740 head:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-52974

A vulnerability was found in the Linux kernel's iscsi tcp drivers. Improper resource allocation management can lead to a use-after-free scenario, triggered when the userspace attempts to access the session host's `ipaddress` attribute while the kernel is performing a session teardown via `iscsi_session_teardown()`.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-52975

A flaw was found in the Linux kernel's Internet Small Computer System Interface (iSCSI) TCP subsystem. A local user can cause a Denial of Service (DoS) or potentially achieve privilege escalation by triggering a use-after-free vulnerability. This issue occurs due to a race condition when an iSCSI session is disconnected while another process queries the host IP address attribute through the sysfs virtual file system, causing the kernel to access memory that has already been deallocated.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-53147

In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-53296

In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK. However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 The fix is to add an unlikely check for the send stream number after the thread wakes up from the wait_for_sndbuf.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-53372

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference it as struct sctp_ifwdtsn_skip may cause coverflow. This patch fixes it by checking the pos against "the end of the chunk - sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to sctp_fwdtsn_skip.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
CVE-2023-53996

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, which forced its callers to round up. As a result, non-page aligned vaddrs caused pages to be spuriously marked as decrypted via the encryption status hypercall, which in turn caused consistent corruption of pages during live migration. Live migration requires accurate encryption status information to avoid migrating pages from the wrong perspective.

5.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Fixed 120 products, the same list as for CVE-2022-49995
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2024:0575 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2087568 external
https://bugzilla.redhat.com/show_bug.cgi?id=2168332 external
https://bugzilla.redhat.com/show_bug.cgi?id=2173403 external
https://bugzilla.redhat.com/show_bug.cgi?id=2173434 external
https://bugzilla.redhat.com/show_bug.cgi?id=2173444 external
https://bugzilla.redhat.com/show_bug.cgi?id=2177389 external
https://bugzilla.redhat.com/show_bug.cgi?id=2182443 external
https://bugzilla.redhat.com/show_bug.cgi?id=2184578 external
https://bugzilla.redhat.com/show_bug.cgi?id=2187773 external
https://bugzilla.redhat.com/show_bug.cgi?id=2192667 external
https://bugzilla.redhat.com/show_bug.cgi?id=2192671 external
https://bugzilla.redhat.com/show_bug.cgi?id=2193219 external
https://bugzilla.redhat.com/show_bug.cgi?id=2213199 external
https://bugzilla.redhat.com/show_bug.cgi?id=2215835 external
https://bugzilla.redhat.com/show_bug.cgi?id=2215836 external
https://bugzilla.redhat.com/show_bug.cgi?id=2215837 external
https://bugzilla.redhat.com/show_bug.cgi?id=2218943 external
https://bugzilla.redhat.com/show_bug.cgi?id=2221463 external
https://bugzilla.redhat.com/show_bug.cgi?id=2221707 external
https://bugzilla.redhat.com/show_bug.cgi?id=2224048 external
https://bugzilla.redhat.com/show_bug.cgi?id=2225191 external
https://bugzilla.redhat.com/show_bug.cgi?id=2230094 external
https://bugzilla.redhat.com/show_bug.cgi?id=2237757 external
https://bugzilla.redhat.com/show_bug.cgi?id=2237760 external
https://bugzilla.redhat.com/show_bug.cgi?id=2240249 external
https://bugzilla.redhat.com/show_bug.cgi?id=2241924 external
https://bugzilla.redhat.com/show_bug.cgi?id=2244723 external
https://bugzilla.redhat.com/show_bug.cgi?id=2246944 external
https://bugzilla.redhat.com/show_bug.cgi?id=2246945 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2022-49995 self
https://bugzilla.redhat.com/show_bug.cgi?id=2373560 external
https://www.cve.org/CVERecord?id=CVE-2022-49995 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49995 external
https://lore.kernel.org/linux-cve-announce/202506… external
https://access.redhat.com/security/cve/CVE-2023-0458 self
https://bugzilla.redhat.com/show_bug.cgi?id=2193219 external
https://www.cve.org/CVERecord?id=CVE-2023-0458 external
https://nvd.nist.gov/vuln/detail/CVE-2023-0458 external
https://github.com/torvalds/linux/commit/73979060… external
https://access.redhat.com/security/cve/CVE-2023-1073 self
https://bugzilla.redhat.com/show_bug.cgi?id=2173403 external
https://www.cve.org/CVERecord?id=CVE-2023-1073 external
https://nvd.nist.gov/vuln/detail/CVE-2023-1073 external
https://git.kernel.org/pub/scm/linux/kernel/git/n… external
https://www.openwall.com/lists/oss-security/2023/… external
https://access.redhat.com/security/cve/CVE-2023-1075 self
https://bugzilla.redhat.com/show_bug.cgi?id=2173434 external
https://www.cve.org/CVERecord?id=CVE-2023-1075 external
https://nvd.nist.gov/vuln/detail/CVE-2023-1075 external
https://access.redhat.com/security/cve/CVE-2023-1079 self
https://bugzilla.redhat.com/show_bug.cgi?id=2173444 external
https://www.cve.org/CVERecord?id=CVE-2023-1079 external
https://nvd.nist.gov/vuln/detail/CVE-2023-1079 external
https://git.kernel.org/pub/scm/linux/kernel/git/n… external
https://access.redhat.com/security/cve/CVE-2023-1838 self
https://bugzilla.redhat.com/show_bug.cgi?id=2087568 external
https://www.cve.org/CVERecord?id=CVE-2023-1838 external
https://nvd.nist.gov/vuln/detail/CVE-2023-1838 external
https://lore.kernel.org/netdev/20220516084213.268… external
https://access.redhat.com/security/cve/CVE-2023-1855 self
https://bugzilla.redhat.com/show_bug.cgi?id=2184578 external
https://www.cve.org/CVERecord?id=CVE-2023-1855 external
https://nvd.nist.gov/vuln/detail/CVE-2023-1855 external
https://lore.kernel.org/all/20230318122758.214086… external
https://access.redhat.com/security/cve/CVE-2023-2162 self
https://bugzilla.redhat.com/show_bug.cgi?id=2187773 external
https://www.cve.org/CVERecord?id=CVE-2023-2162 external
https://nvd.nist.gov/vuln/detail/CVE-2023-2162 external
https://www.spinics.net/lists/linux-scsi/msg181542.html external
https://access.redhat.com/security/cve/CVE-2023-2163 self
https://bugzilla.redhat.com/show_bug.cgi?id=2240249 external
https://www.cve.org/CVERecord?id=CVE-2023-2163 external
https://nvd.nist.gov/vuln/detail/CVE-2023-2163 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-3141 self
https://bugzilla.redhat.com/show_bug.cgi?id=2213199 external
https://www.cve.org/CVERecord?id=CVE-2023-3141 external
https://nvd.nist.gov/vuln/detail/CVE-2023-3141 external
https://lore.kernel.org/lkml/CAPDyKFoV9aZObZ5GBm0… external
https://access.redhat.com/security/cve/CVE-2023-3567 self
https://bugzilla.redhat.com/show_bug.cgi?id=2221463 external
https://www.cve.org/CVERecord?id=CVE-2023-3567 external
https://nvd.nist.gov/vuln/detail/CVE-2023-3567 external
https://www.spinics.net/lists/stable-commits/msg2… external
https://access.redhat.com/security/cve/CVE-2023-3611 self
https://bugzilla.redhat.com/show_bug.cgi?id=2225191 external
https://www.cve.org/CVERecord?id=CVE-2023-3611 external
https://nvd.nist.gov/vuln/detail/CVE-2023-3611 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-3772 self
https://bugzilla.redhat.com/show_bug.cgi?id=2218943 external
https://www.cve.org/CVERecord?id=CVE-2023-3772 external
https://nvd.nist.gov/vuln/detail/CVE-2023-3772 external
https://access.redhat.com/security/cve/CVE-2023-3812 self
https://bugzilla.redhat.com/show_bug.cgi?id=2224048 external
https://www.cve.org/CVERecord?id=CVE-2023-3812 external
https://nvd.nist.gov/vuln/detail/CVE-2023-3812 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-4132 self
https://bugzilla.redhat.com/show_bug.cgi?id=2221707 external
https://www.cve.org/CVERecord?id=CVE-2023-4132 external
https://nvd.nist.gov/vuln/detail/CVE-2023-4132 external
https://access.redhat.com/security/cve/CVE-2023-4622 self
https://bugzilla.redhat.com/show_bug.cgi?id=2237760 external
https://www.cve.org/CVERecord?id=CVE-2023-4622 external
https://nvd.nist.gov/vuln/detail/CVE-2023-4622 external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://access.redhat.com/security/cve/CVE-2023-4623 self
https://bugzilla.redhat.com/show_bug.cgi?id=2237757 external
https://www.cve.org/CVERecord?id=CVE-2023-4623 external
https://nvd.nist.gov/vuln/detail/CVE-2023-4623 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-5178 self
https://bugzilla.redhat.com/show_bug.cgi?id=2241924 external
https://www.cve.org/CVERecord?id=CVE-2023-5178 external
https://nvd.nist.gov/vuln/detail/CVE-2023-5178 external
https://lore.kernel.org/linux-nvme/20231002105428… external
https://access.redhat.com/security/cve/CVE-2023-5717 self
https://bugzilla.redhat.com/show_bug.cgi?id=2246945 external
https://www.cve.org/CVERecord?id=CVE-2023-5717 external
https://nvd.nist.gov/vuln/detail/CVE-2023-5717 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-23455 self
https://bugzilla.redhat.com/show_bug.cgi?id=2168332 external
https://www.cve.org/CVERecord?id=CVE-2023-23455 external
https://nvd.nist.gov/vuln/detail/CVE-2023-23455 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-26545 self
https://bugzilla.redhat.com/show_bug.cgi?id=2182443 external
https://www.cve.org/CVERecord?id=CVE-2023-26545 external
https://nvd.nist.gov/vuln/detail/CVE-2023-26545 external
https://access.redhat.com/security/cve/CVE-2023-28328 self
https://bugzilla.redhat.com/show_bug.cgi?id=2177389 external
https://www.cve.org/CVERecord?id=CVE-2023-28328 external
https://nvd.nist.gov/vuln/detail/CVE-2023-28328 external
https://lore.kernel.org/linux-media/2022112006591… external
https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpq… external
https://access.redhat.com/security/cve/CVE-2023-31436 self
https://bugzilla.redhat.com/show_bug.cgi?id=2192671 external
https://www.cve.org/CVERecord?id=CVE-2023-31436 external
https://nvd.nist.gov/vuln/detail/CVE-2023-31436 external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-33203 self
https://bugzilla.redhat.com/show_bug.cgi?id=2192667 external
https://www.cve.org/CVERecord?id=CVE-2023-33203 external
https://nvd.nist.gov/vuln/detail/CVE-2023-33203 external
https://access.redhat.com/security/cve/CVE-2023-35823 self
https://bugzilla.redhat.com/show_bug.cgi?id=2215835 external
https://www.cve.org/CVERecord?id=CVE-2023-35823 external
https://nvd.nist.gov/vuln/detail/CVE-2023-35823 external
https://access.redhat.com/security/cve/CVE-2023-35824 self
https://bugzilla.redhat.com/show_bug.cgi?id=2215836 external
https://www.cve.org/CVERecord?id=CVE-2023-35824 external
https://nvd.nist.gov/vuln/detail/CVE-2023-35824 external
https://access.redhat.com/security/cve/CVE-2023-35825 self
https://bugzilla.redhat.com/show_bug.cgi?id=2215837 external
https://www.cve.org/CVERecord?id=CVE-2023-35825 external
https://nvd.nist.gov/vuln/detail/CVE-2023-35825 external
https://access.redhat.com/security/cve/CVE-2023-45871 self
https://bugzilla.redhat.com/show_bug.cgi?id=2244723 external
https://www.cve.org/CVERecord?id=CVE-2023-45871 external
https://nvd.nist.gov/vuln/detail/CVE-2023-45871 external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://access.redhat.com/security/cve/CVE-2023-46813 self
https://bugzilla.redhat.com/show_bug.cgi?id=2246944 external
https://www.cve.org/CVERecord?id=CVE-2023-46813 external
https://nvd.nist.gov/vuln/detail/CVE-2023-46813 external
https://bugzilla.suse.com/show_bug.cgi?id=1212649 external
https://cdn.kernel.org/pub/linux/kernel/v6.x/Chan… external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://git.kernel.org/pub/scm/linux/kernel/git/t… external
https://access.redhat.com/security/cve/CVE-2023-52973 self
https://bugzilla.redhat.com/show_bug.cgi?id=2355433 external
https://www.cve.org/CVERecord?id=CVE-2023-52973 external
https://nvd.nist.gov/vuln/detail/CVE-2023-52973 external
https://lore.kernel.org/linux-cve-announce/202503… external
https://access.redhat.com/security/cve/CVE-2023-52974 self
https://bugzilla.redhat.com/show_bug.cgi?id=2355469 external
https://www.cve.org/CVERecord?id=CVE-2023-52974 external
https://nvd.nist.gov/vuln/detail/CVE-2023-52974 external
https://lore.kernel.org/linux-cve-announce/202503… external
https://access.redhat.com/security/cve/CVE-2023-52975 self
https://bugzilla.redhat.com/show_bug.cgi?id=2355519 external
https://www.cve.org/CVERecord?id=CVE-2023-52975 external
https://nvd.nist.gov/vuln/detail/CVE-2023-52975 external
https://lore.kernel.org/linux-cve-announce/202503… external
https://access.redhat.com/security/cve/CVE-2023-53147 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395408 external
https://www.cve.org/CVERecord?id=CVE-2023-53147 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53147 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53296 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395682 external
https://www.cve.org/CVERecord?id=CVE-2023-53296 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53296 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53372 self
https://bugzilla.redhat.com/show_bug.cgi?id=2396405 external
https://www.cve.org/CVERecord?id=CVE-2023-53372 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53372 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53996 self
https://bugzilla.redhat.com/show_bug.cgi?id=2424944 external
https://www.cve.org/CVERecord?id=CVE-2023-53996 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53996 external
https://lore.kernel.org/linux-cve-announce/202512… external
Acknowledgments
ZJU & Ant Security Light-Year Lab Lin Ma
Duoming Zhou
Wei Chen
To clipboard 

Loading 1.5 MB of JSON…



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.