RHSA-2023:1435: Important: kpatch-patch security update
This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel.<br>Security Fix(es):<br><li> kernel: use-after-free caused by l2capreassemblesdu() in net/bluetooth/l2capcore.c (CVE-2022-3564)</li> <li> kernel: stack overflow in doprocdointvec and procskipspaces (CVE-2022-4378)</li> <li> kernel: use-after-free in nfs42sscopen() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379)</li> <li> kernel: Netfilter integer overflow vulnerability in nftpayloadcopyvlan (CVE-2023-0179)</li> <li> ALSA: pcm: Move rwsem lock inside sndctlelemread to prevent UAF (CVE-2023-0266)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:1435?
The severity of RHSA-2023:1435 is classified as important due to CVE-2022-3564, which involves a use-after-free vulnerability in the kernel.
How do I fix RHSA-2023:1435?
To fix RHSA-2023:1435, you should update to the latest version of the kpatch-patch package that is specified in the advisory.
What part of the system is affected by RHSA-2023:1435?
RHSA-2023:1435 affects the kernel live patch module within the Red Hat Enterprise Linux environment.
What is CVE-2022-3564 related to RHSA-2023:1435?
CVE-2022-3564 addresses a use-after-free vulnerability in l2cap_reassemble_sdu() found in the Bluetooth stack of the Linux kernel.
Which package versions are recommended to address RHSA-2023:1435?
The recommended package versions to address RHSA-2023:1435 include kpatch-patch versions 5_14_0-70_22_1-1-6.el9_0 and others listed in the advisory.