Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2023-0059-01

Red Hat Security Advisory 2023-0059-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include an out of bounds write vulnerability.

Packet Storm
#vulnerability#linux#red_hat#rpm#sap

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kpatch-patch security update
Advisory ID: RHSA-2023:0059-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0059
Issue date: 2023-01-10
CVE Names: CVE-2022-2639
=====================================================================

  1. Summary:

An update for kpatch-patch is now available for Red Hat Enterprise Linux
8.1 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux BaseOS E4S (v. 8.1) - ppc64le, x86_64

  1. Description:

This is a kernel live patch module which is automatically loaded by the RPM
post-install script to modify the code of a running kernel.

Security Fix(es):

  • kernel: openvswitch: integer underflow leads to out-of-bounds write in
    reserve_sfa_size() (CVE-2022-2639)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

2084479 - CVE-2022-2639 kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()

  1. Package List:

Red Hat Enterprise Linux BaseOS E4S (v. 8.1):

Source:
kpatch-patch-4_18_0-147_70_1-1-2.el8_1.src.rpm
kpatch-patch-4_18_0-147_74_1-1-2.el8_1.src.rpm
kpatch-patch-4_18_0-147_76_1-1-1.el8_1.src.rpm
kpatch-patch-4_18_0-147_77_1-1-1.el8_1.src.rpm

ppc64le:
kpatch-patch-4_18_0-147_70_1-1-2.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_70_1-debuginfo-1-2.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_70_1-debugsource-1-2.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_74_1-1-2.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_74_1-debuginfo-1-2.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_74_1-debugsource-1-2.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_76_1-1-1.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_76_1-debuginfo-1-1.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_76_1-debugsource-1-1.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_77_1-1-1.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_77_1-debuginfo-1-1.el8_1.ppc64le.rpm
kpatch-patch-4_18_0-147_77_1-debugsource-1-1.el8_1.ppc64le.rpm

x86_64:
kpatch-patch-4_18_0-147_70_1-1-2.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_70_1-debuginfo-1-2.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_70_1-debugsource-1-2.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_74_1-1-2.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_74_1-debuginfo-1-2.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_74_1-debugsource-1-2.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_76_1-1-1.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_76_1-debuginfo-1-1.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_76_1-debugsource-1-1.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_77_1-1-1.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_77_1-debuginfo-1-1.el8_1.x86_64.rpm
kpatch-patch-4_18_0-147_77_1-debugsource-1-1.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2022-2639
https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY73n79zjgjWX9erEAQgKiQ/+LjewZ+MyCvWJ+qhyPc14GCy51ttayGca
fO4urBYkA+HH8jal6201GurCnpquoQsD7CtLW4A3LUeNezKHRVW0v4B7LqqBjTuK
aOXFHApMMF4Hrw1baJnRZq9hF2HLsFA1435v34de6GvNpfvvEBzkrKhrNu45MRf1
Al1I6094u9AIwM/Q67bubgCz51kIXNZX7F4fFygHBMFkW2czAdCTccftW5/+Fw60
13iu/LNsY8UnBKxKYrHkcSBenPEklUFyh1l5FR8oZ3+ao/0oNlC4hoM4zmpY8foi
pBUEtmjGbTLhuMha+1iF3vhTrXK7x6gXWV7JOaZzSM1SvQOjTtAVIcOw94co0pTM
47tfm5uID2bqG9/a0m3sGUkzFd/zh+4sbyKi4un6D5qxVIZ3ZCa0wNGA0PkAiuGb
DusgVo1ws5e7mEjpa/Ec2IE4WswT5+HJwACrizbrSsk/q0DhKLQibdgjkS4Xtoe7
tLdxTYT67dTSnbPjH8WihyNnwuBJTjVOATFeWrjoD7dERXHGxE7wI+mwdzadgz3i
BibnUT03fXgc0nPoyNmJ20neGKjKkWyx7P0fK1DHbfreOe9sIizqwVzthVIphZcJ
dgkr/6ML9/NI7GvPXbgwBa9mMEzge7CnwQoXOCmztOLqcFpxuwKHfX5nsJLTMCE1
VQfi2bo2zrA=
=qZYv
-----END PGP SIGNATURE-----

RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2022-9111-01

Red Hat Security Advisory 2022-9111-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.9.54. Issues addressed include a code execution vulnerability.

Red Hat Security Advisory 2022-8893-01

Red Hat Security Advisory 2022-8893-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.20.

RHSA-2022:8893: Red Hat Security Advisory: OpenShift Container Platform 4.11.20 security update

Red Hat OpenShift Container Platform release 4.11.20 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-27191: golang: crash in a golang.org/x/crypto/ssh server

RHSA-2022:9040: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.6.3 security update

Red Hat Advanced Cluster Management for Kubernetes 2.6.3 General Availability release images, which provide security updates, fix bugs, and update container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3517: nodejs-minimatch: ReDoS via the braceExpand function * CVE-2022-41912: crewjam/saml: Authentication bypass when processing SAML responses containing multiple Assertion elements

Red Hat Security Advisory 2022-8941-01

Red Hat Security Advisory 2022-8941-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include an out of bounds write vulnerability.

RHSA-2022:8940: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1158: kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region * CVE-2022-2639: kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()

RHSA-2022:8831: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1158: kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region * CVE-2022-2639: kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size()

Red Hat Security Advisory 2022-8765-01

Red Hat Security Advisory 2022-8765-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include an out of bounds write vulnerability.

Red Hat Security Advisory 2022-8768-01

Red Hat Security Advisory 2022-8768-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include an out of bounds write vulnerability.

Ubuntu Security Notice USN-5650-1

Ubuntu Security Notice 5650-1 - It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that the virtual terminal driver in the Linux kernel did not properly handle VGA console font changes, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

Packet Storm: Latest News

Ivanti EPM Agent Portal Command Execution