RHSA-2023:2148: Important: kernel-rt security and bug fix update

First published: Tue May 09 2023(Updated: )

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.<br>Security Fix(es):<br><li> use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)</li> <li> net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)</li> <li> hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)</li> <li> malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)</li> <li> possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)</li> <li> KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)</li> <li> use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)</li> <li> KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)</li> <li> netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)</li> <li> race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)</li> <li> out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)</li> <li> race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)</li> <li> memory leak in ipv6_renew_options() (CVE-2022-3524)</li> <li> data races around icsk-&gt;icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)</li> <li> data races around sk-&gt;sk_prot (CVE-2022-3567)</li> <li> memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)</li> <li> denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)</li> <li> use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)</li> <li> USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)</li> <li> use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)</li> <li> Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)</li> <li> mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)</li> <li> l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)</li> <li> igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)</li> <li> lockdown bypass using IMA (CVE-2022-21505)</li> <li> double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)</li> <li> network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)</li> <li> unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)</li> <li> TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)</li> <li> u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)</li> <li> use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)</li> <li> use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)</li> <li> BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)</li> <li> Denial of service in beacon protection for P2P-device (CVE-2022-42722)</li> <li> memory corruption in usbmon driver (CVE-2022-43750)</li> <li> NULL pointer dereference in traffic control subsystem (CVE-2022-47929)</li> <li> NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)</li> <li> use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)</li> <li> use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)</li> <li> denial of service in tipc_conn_close (CVE-2023-1382)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Additional Changes:<br>For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2023:2148
• agent/software-canonical-lookup
• package-manager/redhat