RHSA-2023:1008: Important: kpatch-patch security update
This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel.Security Fix(es): kernel: use-after-free caused by l2capreassemblesdu() in net/bluetooth/l2capcore.c (CVE-2022-3564) kernel: stack overflow in doprocdointvec and procskipspaces (CVE-2022-4378) kernel: use-after-free in nfs42sscopen() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379) kernel: Netfilter integer overflow vulnerability in nftpayloadcopyvlan (CVE-2023-0179) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kpatch-patchto a version that resolves this vulnerability.Fixed in 5_14_0-162_12_1-1-1.el9_1 - Upgrade
Upgrade
redhat/kpatch-patchto a version that resolves this vulnerability.Fixed in 5_14_0-162_6_1-1-2.el9_1 - Upgrade
Upgrade
redhat/kpatch-patchto a version that resolves this vulnerability.Fixed in 5_14_0-162_12_1-debuginfo-1-1.el9_1 - Upgrade
Upgrade
redhat/kpatch-patchto a version that resolves this vulnerability.Fixed in 5_14_0-162_12_1-debugsource-1-1.el9_1 - Upgrade
Upgrade
redhat/kpatch-patchto a version that resolves this vulnerability.Fixed in 5_14_0-162_6_1-debuginfo-1-2.el9_1 - Upgrade
Upgrade
redhat/kpatch-patchto a version that resolves this vulnerability.Fixed in 5_14_0-162_6_1-debugsource-1-2.el9_1
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:1008?
The severity of RHSA-2023:1008 is considered critical due to a use-after-free vulnerability in the kernel affecting Bluetooth functionalities.
How do I fix RHSA-2023:1008?
To fix RHSA-2023:1008, you should update to the latest kpatch-patch version as specified in the advisory.
Which software packages are affected by RHSA-2023:1008?
RHSA-2023:1008 affects various versions of the kpatch-patch package across multiple architectures.
What is the impact of the vulnerability in RHSA-2023:1008?
The impact of the vulnerability in RHSA-2023:1008 may allow an attacker to escalate privileges or execute arbitrary code on the affected systems.
Is there a CVE associated with RHSA-2023:1008?
Yes, RHSA-2023:1008 includes the CVE-2022-3564, which details the specific use-after-free vulnerability.