Headline

Red Hat Security Advisory 2022-6741-01

Red Hat Security Advisory 2022-6741-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include a privilege escalation vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #sap

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2022:6741-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6741
Issue date: 2022-09-28
CVE Names: CVE-2022-1729
=====================================================================

Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.7
Advanced Update Support, Red Hat Enterprise Linux 7.7 Telco Extended Update
Support, and Red Hat Enterprise Linux 7.7 Update Services for SAP
Solutions.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.7) - noarch, x86_64
Red Hat Enterprise Linux Server E4S (v. 7.7) - noarch, ppc64le, x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 7.7) - x86_64
Red Hat Enterprise Linux Server Optional E4S (v. 7.7) - ppc64le, x86_64
Red Hat Enterprise Linux Server Optional TUS (v. 7.7) - x86_64
Red Hat Enterprise Linux Server TUS (v. 7.7) - noarch, x86_64

Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

kernel: race condition in perf_event_open leads to privilege escalation
(CVE-2022-1729)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

Posix ACL object is leaked in several places upon setattr and fsetxattr
syscalls (BZ#2106586)
netfilter: backports from upstream (BZ#2120634)

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Bugs fixed (https://bugzilla.redhat.com/):

2086753 - CVE-2022-1729 kernel: race condition in perf_event_open leads to privilege escalation

Package List:

Red Hat Enterprise Linux Server AUS (v. 7.7):

Source:
kernel-3.10.0-1062.70.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1062.70.1.el7.noarch.rpm
kernel-doc-3.10.0-1062.70.1.el7.noarch.rpm

x86_64:
bpftool-3.10.0-1062.70.1.el7.x86_64.rpm
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debug-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-devel-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-headers-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-tools-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-1062.70.1.el7.x86_64.rpm
perf-3.10.0-1062.70.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
python-perf-3.10.0-1062.70.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server E4S (v. 7.7):

Source:
kernel-3.10.0-1062.70.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1062.70.1.el7.noarch.rpm
kernel-doc-3.10.0-1062.70.1.el7.noarch.rpm

ppc64le:
bpftool-3.10.0-1062.70.1.el7.ppc64le.rpm
bpftool-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debug-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-devel-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-headers-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-tools-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-1062.70.1.el7.ppc64le.rpm
perf-3.10.0-1062.70.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
python-perf-3.10.0-1062.70.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Server TUS (v. 7.7):

Source:
kernel-3.10.0-1062.70.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1062.70.1.el7.noarch.rpm
kernel-doc-3.10.0-1062.70.1.el7.noarch.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 7.7):

x86_64:
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-1062.70.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional E4S (v. 7.7):

ppc64le:
bpftool-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-1062.70.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Server Optional TUS (v. 7.7):

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2022-1729
https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBYzSXBtzjgjWX9erEAQjKrQ//UMJzCqtbTKo49Rw2Q5bNpiBbMYIczHLu
uVWQDb82h2K2Ky3qpGHMIQuhMb/pr0k+9Q+MzjEzkIEnDW4iwXvApz2snWy+jXD9
nqnsBPuQqU/4bCGIJYRw+b6/onxXUzFU58opqkoOcOR1bEpc+7VTCwGwH6KExb3s
X6BQTyLmIHkcdMl6qzDtw4JqU591mDgujbxAXo/FTh2C2gIaFV1/TWHNNRe6OoDJ
1HQqthx4aWoY4rK2cHLdwuG0gdGK6QTy/lEAu0+79YiVYrBgWK5yTuyyyLGD8SXQ
Fn+c4KMjIO3I1FbQwzGmYuRjrQjatJZJczRt+MLo5DxoSbraf7Y7zn3lI6VtKPX9
snqgjZ6vZ0AUkN2bMRRtiA0QRTkqy/FAr+OlSdJaLCLGXRKZfk8vh7Es4bYpO8Mx
2GzpwthdFyyWcgyoEDI6WCp4t4oaAkKZu5rLoa8563icrcTLRMAdUM4IMNuUOI1q
S4ovejF2K4G7gaUS2V/i5N298+B8vr10yEtNPHiQ7SZKdjQ+SXD+fkr2Joz/GsSo
ozjIYjBsi/Oglk3G7CVJPWUVWf+CsLZHg3ucSsCT2FMFkACtZLbht1wEHzg5kvWc
Qj6KpVi4RJ+ZrYrMCi0EB0ejYbQrkLQpCBIRmN7zLrEyPB+qTq2yquYHffmSpdmW
jfydo6q/6as=
=rbbu
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2022-6271-01

Red Hat Security Advisory 2022-6271-01 - This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. Issues addressed include a denial of service vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #red_hat #dos #js #kubernetes

Red Hat Security Advisory 2022-5070-01

Red Hat Security Advisory 2022-5070-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.11.0. Issues addressed include denial of service, out of bounds read, and traversal vulnerabilities.

2 years ago

Packet Storm

Open in Source

#vulnerability #red_hat #dos #js #git #kubernetes #rpm

RHSA-2022:5879: Red Hat Security Advisory: OpenShift Container Platform 4.9.45 bug fix and security update

Red Hat OpenShift Container Platform release 4.9.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2403: openshift: oauth-serving-cert configmap contains cluster certificate private key

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #web #mac #linux #red_hat #nodejs #js #java #kubernetes #aws #oauth #auth #ibm #rpm

Red Hat Security Advisory 2022-5806-01

Red Hat Security Advisory 2022-5806-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include privilege escalation and use-after-free vulnerabilities.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

RHSA-2022:5730: Red Hat Security Advisory: OpenShift Container Platform 4.10.25 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.25 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23772: golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-24921...

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #ssh #ibm #rpm

RHSA-2022:5633: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-29368: kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check * CVE-2021-4197: kernel: cgroup: Use open-time creds and namespace for migration perm checks * CVE-2021-4203: kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses * CVE-202...

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws

RHSA-2022:5249: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1012: kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak * CVE-2022-1729: kernel: race condition in perf_event_open leads to privilege escalation * CVE-2022-1966: kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root * CVE-2022-27666: kernel: buffer overf...

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #buffer_overflow #ibm #sap

Red Hat Security Advisory 2022-5224-01

Red Hat Security Advisory 2022-5224-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include buffer overflow, information leakage, privilege escalation, and use-after-free vulnerabilities.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js #buffer_overflow

RHSA-2022:5220: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-29368: kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check * CVE-2022-1012: kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak * CVE-2022-1729: kernel: race condition in perf_event_open leads to priv...

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #buffer_overflow #ibm #sap

RHSA-2022:5267: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1012: kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak * CVE-2022-1729: kernel: race condition in perf_event_open leads to privilege escalation * CVE-2022-1966: kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root * CVE-2022-27666: kernel: buffer ov...

2 years ago

Red Hat Security Data

Open in Source