Headline

Red Hat Security Advisory 2023-4151-01

Red Hat Security Advisory 2023-4151-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include a use-after-free vulnerability.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2023:4151-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4151
Issue date: 2023-07-18
CVE Names: CVE-2022-3564
=====================================================================

Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security Fix(es):

kernel: use-after-free caused by l2cap_reassemble_sdu() in
net/bluetooth/l2cap_core.c (CVE-2022-3564)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

perf record -ag does not capture user space stack frames on s390x
(BZ#2207745)
RHEL7.9 - kernel: handle new reply code FILTERED_BY_HYPERVISOR
(BZ#2212672)

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Bugs fixed (https://bugzilla.redhat.com/):

2150999 - CVE-2022-3564 kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c

Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
kernel-3.10.0-1160.95.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.95.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.95.1.el7.noarch.rpm

x86_64:
bpftool-3.10.0-1160.95.1.el7.x86_64.rpm
bpftool-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debug-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debug-devel-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-devel-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-headers-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-tools-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-tools-libs-3.10.0-1160.95.1.el7.x86_64.rpm
perf-3.10.0-1160.95.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
python-perf-3.10.0-1160.95.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
bpftool-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-debuginfo-common-x86_64-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-tools-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
kernel-tools-libs-devel-3.10.0-1160.95.1.el7.x86_64.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
kernel-3.10.0-1160.95.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.95.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.95.1.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Red Hat Enterprise Linux Server (v. 7):

Source:
kernel-3.10.0-1160.95.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.95.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.95.1.el7.noarch.rpm

ppc64:
bpftool-3.10.0-1160.95.1.el7.ppc64.rpm
bpftool-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-bootwrapper-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debug-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debug-devel-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-devel-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-headers-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-tools-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-tools-libs-3.10.0-1160.95.1.el7.ppc64.rpm
perf-3.10.0-1160.95.1.el7.ppc64.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
python-perf-3.10.0-1160.95.1.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm

ppc64le:
bpftool-3.10.0-1160.95.1.el7.ppc64le.rpm
bpftool-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-bootwrapper-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debug-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-devel-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-headers-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-tools-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-tools-libs-3.10.0-1160.95.1.el7.ppc64le.rpm
perf-3.10.0-1160.95.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
python-perf-3.10.0-1160.95.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm

s390x:
bpftool-3.10.0-1160.95.1.el7.s390x.rpm
bpftool-debuginfo-3.10.0-1160.95.1.el7.s390x.rpm
kernel-3.10.0-1160.95.1.el7.s390x.rpm
kernel-debug-3.10.0-1160.95.1.el7.s390x.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.s390x.rpm
kernel-debug-devel-3.10.0-1160.95.1.el7.s390x.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.s390x.rpm
kernel-debuginfo-common-s390x-3.10.0-1160.95.1.el7.s390x.rpm
kernel-devel-3.10.0-1160.95.1.el7.s390x.rpm
kernel-headers-3.10.0-1160.95.1.el7.s390x.rpm
kernel-kdump-3.10.0-1160.95.1.el7.s390x.rpm
kernel-kdump-debuginfo-3.10.0-1160.95.1.el7.s390x.rpm
kernel-kdump-devel-3.10.0-1160.95.1.el7.s390x.rpm
perf-3.10.0-1160.95.1.el7.s390x.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.s390x.rpm
python-perf-3.10.0-1160.95.1.el7.s390x.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.s390x.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:
bpftool-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-debuginfo-common-ppc64-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-tools-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
kernel-tools-libs-devel-3.10.0-1160.95.1.el7.ppc64.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.ppc64.rpm

ppc64le:
bpftool-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debug-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debug-devel-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-debuginfo-common-ppc64le-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-tools-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
kernel-tools-libs-devel-3.10.0-1160.95.1.el7.ppc64le.rpm
perf-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm
python-perf-debuginfo-3.10.0-1160.95.1.el7.ppc64le.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
kernel-3.10.0-1160.95.1.el7.src.rpm

noarch:
kernel-abi-whitelists-3.10.0-1160.95.1.el7.noarch.rpm
kernel-doc-3.10.0-1160.95.1.el7.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2022-3564
https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIcBAEBCAAGBQJktmwSAAoJENzjgjWX9erEt6cP/1fkp69jI6fbByZXKQSjLw0f
F+P+X+ZpO/+WFU2DSA8re83/9dRg0tJCHpQXSCnVqMdd+lvMqqXALldIn37rm03X
O+x/InkmzJrnwhna5viIF/hHmj3q1n0P3zxqkv1A2sWXbD71HYQgTZUQ7AJ1xCQg
J913u1Aq7CQv3DZgU30AhaYqFYubZCAIxOg093k1tE46IhaM8kaZ0+/YlzazBaeY
o8yjkdl86qPxb+E+aEp01GfkWDVz2oKrjZzG5RH6pEnbbIcV4fg8xR14cVFAoMql
7+Lwa+SMN/3x0S2yMQk5nXVoEm2m3m2OBHZjFj3GvYKJBrfrgbTb5cyferOImEqE
mRNNxQpPeUQNQDlOAQp6uC0ODUcVoAWOT/CRqhP9zK2oU//yxv4l4/DkCJUQbQZh
Y+PFt5SlFPdoFvy4dG4SfJoA8F9QfXJ7T3arjyrAikM0AS+tZ53wKTSTvvUbLWR7
8yA/ICqMD7HMco9LB5CPEOyIyJTNe86EODzIQlzeCwi7h5uSSWfF/WNvXr/oruTR
Nu6TqkO0NSw3SdkZlNjZR5FojxmGQ+FUff0Xd+jTEz4m6DgQMDIRXpxZ3eixBALl
L26AUp/LirMgpitXCobe456SqbSDEXndP+rLE9DUbJ8PUrsDja0nnVQsePCYyFUe
Kd+YqMTvBv9Q3TVer7fj
=5yWc
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138

1 year ago

CVE

Open in Source

#sql #xss #vulnerability #web #mac #google #linux #dos #apache #js #git #java #oracle #ldap #vmware #graalvm #buffer_overflow #auth #ssh #ibm

Red Hat Security Advisory 2023-4020-01

Red Hat Security Advisory 2023-4020-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include double free and use-after-free vulnerabilities.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #linux #red_hat #js

Red Hat Security Advisory 2023-1393-01

Red Hat Security Advisory 2023-1393-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.55.

1 year ago

Packet Storm

Open in Source

#sql #vulnerability #web #red_hat #git #kubernetes #c++#rpm

RHSA-2023:1393: Red Hat Security Advisory: OpenShift Container Platform 4.10.55 security update

Red Hat OpenShift Container Platform release 4.10.55 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: A flaw was found in goutils where randomly generated alphanumeric strings contain significantly less entropy than expected. Both the `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This issu...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #git #java #kubernetes #aws #ibm #rpm

Red Hat Security Advisory 2023-1202-01

Red Hat Security Advisory 2023-1202-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, integer overflow, and use-after-free vulnerabilities.

1 year ago

Packet Storm

Open in Source

#vulnerability #ios #linux #red_hat #dos #intel #sap

Red Hat Security Advisory 2023-1220-01

Red Hat Security Advisory 2023-1220-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include a use-after-free vulnerability.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js #c++

Red Hat Security Advisory 2023-1203-01

Red Hat Security Advisory 2023-1203-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include denial of service, integer overflow, and use-after-free vulnerabilities.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #dos #js #dell

RHSA-2023:1221: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3564: A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges. * CVE-2022-4269: A flaw was found ...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #mac #linux #red_hat #dos #ibm #sap

RHSA-2023:1220: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3564: A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges. * CVE-2022-4269: A flaw was fou...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #dos #nodejs #js #java #kubernetes #aws

RHSA-2023:1202: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3564: A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges. * CVE-2022-4269: A flaw was found ...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #intel #buffer_overflow #ibm #sap

RHSA-2023:1203: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3564: A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges. * CVE-2022-4269: A flaw was fou...

1 year ago

Red Hat Security Data

Open in Source