Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2023-5245-01

Red Hat Security Advisory 2023-5245-01 - The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Issues addressed include an information leakage vulnerability.

Packet Storm
#vulnerability#linux#red_hat#git#amd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: linux-firmware security update
Advisory ID: RHSA-2023:5245-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5245
Issue date: 2023-09-19
CVE Names: CVE-2023-20593
=====================================================================

  1. Summary:

An update for linux-firmware is now available for Red Hat Enterprise Linux

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux BaseOS (v. 8) - noarch

  1. Description:

The linux-firmware packages contain all of the firmware files that are
required by various devices to operate.

Security Fix(es):

  • hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

2217845 - CVE-2023-20593 hw: amd: Cross-Process Information Leak

  1. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
linux-firmware-20230404-117.git2e92a49f.el8_8.src.rpm

noarch:
iwl100-firmware-39.31.5.1-117.el8_8.1.noarch.rpm
iwl1000-firmware-39.31.5.1-117.el8_8.1.noarch.rpm
iwl105-firmware-18.168.6.1-117.el8_8.1.noarch.rpm
iwl135-firmware-18.168.6.1-117.el8_8.1.noarch.rpm
iwl2000-firmware-18.168.6.1-117.el8_8.1.noarch.rpm
iwl2030-firmware-18.168.6.1-117.el8_8.1.noarch.rpm
iwl3160-firmware-25.30.13.0-117.el8_8.1.noarch.rpm
iwl3945-firmware-15.32.2.9-117.el8_8.1.noarch.rpm
iwl4965-firmware-228.61.2.24-117.el8_8.1.noarch.rpm
iwl5000-firmware-8.83.5.1_1-117.el8_8.1.noarch.rpm
iwl5150-firmware-8.24.2.2-117.el8_8.1.noarch.rpm
iwl6000-firmware-9.221.4.1-117.el8_8.1.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-117.el8_8.1.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-117.el8_8.1.noarch.rpm
iwl6050-firmware-41.28.5.1-117.el8_8.1.noarch.rpm
iwl7260-firmware-25.30.13.0-117.el8_8.1.noarch.rpm
libertas-sd8686-firmware-20230404-117.git2e92a49f.el8_8.noarch.rpm
libertas-sd8787-firmware-20230404-117.git2e92a49f.el8_8.noarch.rpm
libertas-usb8388-firmware-20230404-117.git2e92a49f.el8_8.noarch.rpm
libertas-usb8388-olpc-firmware-20230404-117.git2e92a49f.el8_8.noarch.rpm
linux-firmware-20230404-117.git2e92a49f.el8_8.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2023-20593
https://access.redhat.com/security/updates/classification/#moderate

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJlCb3CAAoJENzjgjWX9erEG6YP/ixHmP1HOI8G/W4LZGBZH4bG
RQEbX+d0DkLDHl9OauCIlz6QwQkXUl3vOES2eU+NnATYxyfe8E7AOi3b/Ncyx1Di
Iht8/TtpAEJ0O5xHFzsfzH+9M4qCABPtmcDVD58Qnl9AuByJpUamt3aWi2DAxBOC
HpmKwM/e8UNjvcJjCBLy/CwyV9VlH8mRkKz6RGEOTAkV2KcKuuvaaNrV2iHv0Hwu
npx6PTPTvZIS6mlZRxoDIgTbloSasWozQEhTWMMxSnCGl5nmIr4oDISGQ4K5H53i
JXoSFoL6tZslB7Jy1PpAgUK2cQTW9N0vqaZPjwTl094qj2XXOpJmGZ4rqPfraOhp
EqawHOlSk33QNXjhZPvpMS879fkssoTPUvju8IG88zVl5h16GXrbOlnecTKggsjU
UXtPWKlhxdwNsb5XBlXVOLmcNvgWccHR/rzoTDoG8FPPHlWi+EvynupRNC8qNz+/
aUptJb4b0WC+ZGq07+q3ax0WscEb/1QNSM/uh8LyOeqs5HKv3EAqjN8MaO/xuUcQ
DawrU43O/XHQHjEWEQmSklceOEw0goVNGWCvpazvPINMe83b6wOLQ5gLHC3tPwJ3
1vj4Qtav8z4r1ntitdQLsQs7PeIRAfsgdiIkFRTMRrGqBhxOiOR7XHkioinRIidC
eelFFuziP2dXbTX6cuhv
=Kzcq
-----END PGP SIGNATURE-----

RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Ubuntu Security Notice USN-6532-1

Ubuntu Security Notice 6532-1 - Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service.

Red Hat Security Advisory 2023-7513-01

Red Hat Security Advisory 2023-7513-01 - An update for linux-firmware is now available for Red Hat Enterprise Linux 7. Issues addressed include an information leakage vulnerability.

CVE-2023-22130: Oracle Critical Patch Update Advisory - October 2023

Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

Red Hat Security Advisory 2023-5607-01

Red Hat Security Advisory 2023-5607-01 - The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Issues addressed include an information leakage vulnerability.

RHSA-2023:5607: Red Hat Security Advisory: linux-firmware security and enhancement update

An update for linux-firmware is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-20593: A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances.

Ubuntu Security Notice USN-6348-1

Ubuntu Security Notice 6348-1 - Daniel Moghimi discovered that some Intel Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information.

Ubuntu Security Notice USN-6342-1

Ubuntu Security Notice 6342-1 - Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle locking during table_clear operations. A local attacker could use this to cause a denial of service.

Ubuntu Security Notice USN-6330-1

Ubuntu Security Notice 6330-1 - Daniel Moghimi discovered that some Intel Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information.

Ubuntu Security Notice USN-6324-1

Ubuntu Security Notice 6324-1 - Daniel Moghimi discovered that some Intel Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information.

RHSA-2023:4819: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-20593: A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances. * CVE-2023-35788: A flaw was found in the TC flower classifier (cls_flower) in the Networking subsystem of the Linux kernel. This issue occurs when sending two TCA_FLOWER_KEY_ENC_OPTS_GENEVE pa...

RHSA-2023:4821: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-20593: A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances. * CVE-2023-35788: A flaw was found in the TC flower classifier (cls_flower) in the Networking subsystem of the Linux kernel. This issue occurs when sending two TCA_FLOWER_KEY_ENC_OPTS_GENEVE...

Red Hat Security Advisory 2023-4696-01

Red Hat Security Advisory 2023-4696-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include information leakage, privilege escalation, and use-after-free vulnerabilities.

RHSA-2023:4696: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-20593: A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances. * CVE-2023-32233: A use-after-free vulnerability was found in the Netfilter subsystem of the Linux kernel when processing batch requests to update nf_tables configurat...

Debian Security Advisory 5462-1

Debian Linux Security Advisory 5462-1 - Tavis Ormandy discovered that under specific microarchitectural circumstances, a vector register in AMD "Zen 2" CPUs may not be written to 0 correctly. This flaw allows an attacker to leak sensitive information across concurrent processes, hyper threads and virtualized guests.

Debian Security Advisory 5461-1

Debian Linux Security Advisory 5461-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

Packet Storm: Latest News

Zeek 6.0.9