rhsa-2024_3414
Vulnerability from csaf_redhat
Published
2024-05-28 14:08
Modified
2024-09-16 19:03
Summary
Red Hat Security Advisory: kernel-rt security and bug fix update
Notes
Topic
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
* kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)
* kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
* kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVE-2023-52628)
* kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)
* kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
Bug Fix(es):
* kernel-rt: update RT source tree to the latest RHEL-9.0.z Batch 17 (JIRA:RHEL-32673)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)\n\n* kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)\n\n* kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)\n\n* kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVE-2023-52628)\n\n* kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)\n\n* kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817) \n\nBug Fix(es):\n\n* kernel-rt: update RT source tree to the latest RHEL-9.0.z Batch 17 (JIRA:RHEL-32673)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:3414",
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2235306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235306"
},
{
"category": "external",
"summary": "2250843",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2250843"
},
{
"category": "external",
"summary": "2255139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255139"
},
{
"category": "external",
"summary": "2262126",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262126"
},
{
"category": "external",
"summary": "2265645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265645"
},
{
"category": "external",
"summary": "2272041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272041"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3414.json"
}
],
"title": "Red Hat Security Advisory: kernel-rt security and bug fix update",
"tracking": {
"current_release_date": "2024-09-16T19:03:47+00:00",
"generator": {
"date": "2024-09-16T19:03:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2024:3414",
"initial_release_date": "2024-05-28T14:08:28+00:00",
"revision_history": [
{
"date": "2024-05-28T14:08:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-05-28T14:08:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-16T19:03:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product": {
"name": "Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.0::nfv"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product": {
"name": "Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.0::realtime"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"product": {
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"product_id": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt@5.14.0-70.101.1.rt21.173.el9_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-core@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-core@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-devel@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-kvm@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-modules@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-modules-extra@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-devel@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-kvm@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-modules@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-modules-extra@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debuginfo@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product": {
"name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_id": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@5.14.0-70.101.1.rt21.173.el9_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src"
},
"product_reference": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)",
"product_id": "NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "NFV-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src"
},
"product_reference": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.0)",
"product_id": "RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
},
"product_reference": "kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"relates_to_product_reference": "RT-9.0.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Bien Pham (https://sea.com)"
],
"organization": "Team Orca of Sea Security Team"
}
],
"cve": "CVE-2023-4244",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2023-08-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2235306"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s nftables sub-component due to a race problem between the set GC and transaction in the Linux Kernel. This flaw allows a local attacker to crash the system due to a missing call to `nft_set_elem_mark_busy`, causing double deactivation of the element and possibly leading to a kernel information leak problem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace.\n\nAnd,\n\nOn non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0:\n\n$ echo \"user.max_user_namespaces=0\" \u003e /etc/sysctl.d/userns.conf\n$ sysctl -p /etc/sysctl.d/userns.conf\n\nOn containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-4244"
},
{
"category": "external",
"summary": "RHBZ#2235306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235306"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-4244",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4244"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4244",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4244"
},
{
"category": "external",
"summary": "https://lore.kernel.org/netdev/20230810070830.24064-1-pablo@netfilter.org/",
"url": "https://lore.kernel.org/netdev/20230810070830.24064-1-pablo@netfilter.org/"
},
{
"category": "external",
"summary": "https://lore.kernel.org/netdev/20230815223011.7019-1-fw@strlen.de/",
"url": "https://lore.kernel.org/netdev/20230815223011.7019-1-fw@strlen.de/"
}
],
"release_date": "2023-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
},
{
"category": "workaround",
"details": "Mitigation for this issue is to skip loading the affected module \"nftables\" onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time.\n~~~\nHow do I blacklist a kernel module to prevent it from loading automatically?\nhttps://access.redhat.com/solutions/41278 \n~~~",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction"
},
{
"cve": "CVE-2023-6240",
"cwe": {
"id": "CWE-203",
"name": "Observable Discrepancy"
},
"discovery_date": "2023-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2250843"
}
],
"notes": [
{
"category": "description",
"text": "A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-6240"
},
{
"category": "external",
"summary": "RHBZ#2250843",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2250843"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-6240",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6240"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6240",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6240"
},
{
"category": "external",
"summary": "https://people.redhat.com/~hkario/marvin/",
"url": "https://people.redhat.com/~hkario/marvin/"
},
{
"category": "external",
"summary": "https://securitypitfalls.wordpress.com/2023/10/16/experiment-with-side-channel-attacks-yourself/",
"url": "https://securitypitfalls.wordpress.com/2023/10/16/experiment-with-side-channel-attacks-yourself/"
}
],
"release_date": "2023-09-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation"
},
{
"acknowledgments": [
{
"names": [
"Xingyuan Mo of IceSword Lab"
]
}
],
"cve": "CVE-2023-6817",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2023-12-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2255139"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the Netfilter subsystem in the Linux kernel via the nft_pipapo_walk function. This issue may allow a local user with CAP_NET_ADMIN capability to trigger an application crash, information disclosure, or local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: inactive elements in nft_pipapo_walk",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Only local users with `CAP_NET_ADMIN` capability or root can trigger this issue. \nOn Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability.\n\nThe OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, therefore, it is also affected by this kernel vulnerability. A successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access. A local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching the namespace in the running OpenShift container will not bring necessary capabilities.\nThis means that for OpenShift, the impact of this vulnerability is Low.\n\nSimilar to the CVE-2023-32233 vulnerability, this has been explained in the following blog post as an example of a \"Container escape vulnerability\":\nhttps://www.redhat.com/en/blog/containers-vulnerability-risk-assessment",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-6817"
},
{
"category": "external",
"summary": "RHBZ#2255139",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255139"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-6817",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6817"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=317eb9685095678f2c9f5a8189de698c5354316a",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=317eb9685095678f2c9f5a8189de698c5354316a"
}
],
"release_date": "2023-12-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
},
{
"category": "workaround",
"details": "In order to trigger the issue, it requires the ability to create user/net namespaces.\n\nOn non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:\n\n# echo \"user.max_user_namespaces=0\" \u003e /etc/sysctl.d/userns.conf\n# sysctl -p /etc/sysctl.d/userns.conf\n\nOn containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: inactive elements in nft_pipapo_walk"
},
{
"cve": "CVE-2023-52628",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2024-03-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2272041"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds write flaw was found in the Linux kernel\u2019s Netfilter functionality. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is fixed in Red Hat Enterprise Linux 9.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52628"
},
{
"category": "external",
"summary": "RHBZ#2272041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272041"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52628",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52628"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52628",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52628"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2024032850-CVE-2023-52628-14fb@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2024032850-CVE-2023-52628-14fb@gregkh/T"
}
],
"release_date": "2024-03-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
},
{
"category": "workaround",
"details": "In order to trigger the issue, it requires the ability to create user/net namespaces.\n\nOn non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:\n\n# echo \"user.max_user_namespaces=0\" \u003e /etc/sysctl.d/userns.conf\n# sysctl -p /etc/sysctl.d/userns.conf\n\nOn containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write"
},
{
"cve": "CVE-2024-1086",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2024-01-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2262126"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nft_verdict_init() function, allowing positive values as a drop error within the hook verdict, therefore, the nf_hook_slow() function can cause a double-free vulnerability when NF_DROP is issued with a drop error that resembles NF_ACCEPT. The nf_tables component can be exploited to achieve local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as having an Important impact. There is the limitation that it can only be exploited by a local user with access to Netfilter, but can still allow privilege escalation if user namespaces are enabled and Netfilter is being used.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-1086"
},
{
"category": "external",
"summary": "RHBZ#2262126",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262126"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-1086",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1086"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660"
},
{
"category": "external",
"summary": "https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660",
"url": "https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2024-01-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
},
{
"category": "workaround",
"details": "1. This flaw can be mitigated by preventing the affected netfilter (nf_tables) kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.\n\n2. If the module cannot be disabled, on non-containerized deployments of Red Hat Enterprise Linux, the mitigation is to disable user namespaces:\n```\n# echo \"user.max_user_namespaces=0\" \u003e /etc/sysctl.d/userns.conf\n# sysctl -p /etc/sysctl.d/userns.conf\n```\nOn containerized deployments, such as Red Hat OpenShift Container Platform, do not use the second mitigation (disabling user namespaces) as the functionality is needed to be enabled. The first mitigation (blacklisting nf_tables) is still viable for containerized deployments, providing the environment is not using netfilter.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2024-05-30T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function"
},
{
"cve": "CVE-2024-26586",
"discovery_date": "2024-02-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2265645"
}
],
"notes": [
{
"category": "description",
"text": "A kernel stack flaw that corrupted the Linux kernel\u2019s Mellanox Technologies Spectrum Ethernet driver was found when a user initialized more than 16 access control lists (ACLs). This flaw allows a local user\u00a0to crash or potentially escalate their privileges on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-26586"
},
{
"category": "external",
"summary": "RHBZ#2265645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-26586",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26586"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-26586",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26586"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2024022253-CVE-2024-26586-6632@gregkh/T/#u",
"url": "https://lore.kernel.org/linux-cve-announce/2024022253-CVE-2024-26586-6632@gregkh/T/#u"
}
],
"release_date": "2024-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3414"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the mlxsw_spectrum module from being loaded. Please see https://access.redhat.com/solutions/41278 for information on blacklisting a kernel module to prevent it from loading automatically.",
"product_ids": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"NFV-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"NFV-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.src",
"RT-9.0.0.Z.EUS:kernel-rt-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-debuginfo-common-x86_64-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-devel-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-kvm-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64",
"RT-9.0.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-70.101.1.rt21.173.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption"
}
]
}
Loading...