Headline
Red Hat Security Advisory 2023-1984-01
Red Hat Security Advisory 2023-1984-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: kpatch-patch security update
Advisory ID: RHSA-2023:1984-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1984
Issue date: 2023-04-25
CVE Names: CVE-2023-0386
====================================================================
- Summary:
An update for kpatch-patch is now available for Red Hat Enterprise Linux
9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux BaseOS EUS (v.9.0) - ppc64le, x86_64
- Description:
This is a kernel live patch module which is automatically loaded by the RPM
post-install script to modify the code of a running kernel.
Security Fix(es):
- kernel: FUSE filesystem low-privileged user privileges escalation
(CVE-2023-0386)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2159505 - CVE-2023-0386 kernel: FUSE filesystem low-privileged user privileges escalation
- Package List:
Red Hat Enterprise Linux BaseOS EUS (v.9.0):
Source:
kpatch-patch-5_14_0-70_30_1-1-5.el9_0.src.rpm
kpatch-patch-5_14_0-70_36_1-1-4.el9_0.src.rpm
kpatch-patch-5_14_0-70_43_1-1-3.el9_0.src.rpm
kpatch-patch-5_14_0-70_49_1-1-2.el9_0.src.rpm
kpatch-patch-5_14_0-70_50_2-1-1.el9_0.src.rpm
ppc64le:
kpatch-patch-5_14_0-70_30_1-1-5.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_30_1-debuginfo-1-5.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_30_1-debugsource-1-5.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_36_1-1-4.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_36_1-debuginfo-1-4.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_36_1-debugsource-1-4.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_43_1-1-3.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_43_1-debuginfo-1-3.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_43_1-debugsource-1-3.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_49_1-1-2.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_49_1-debuginfo-1-2.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_49_1-debugsource-1-2.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_50_2-1-1.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_50_2-debuginfo-1-1.el9_0.ppc64le.rpm
kpatch-patch-5_14_0-70_50_2-debugsource-1-1.el9_0.ppc64le.rpm
x86_64:
kpatch-patch-5_14_0-70_30_1-1-5.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_30_1-debuginfo-1-5.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_30_1-debugsource-1-5.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_36_1-1-4.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_36_1-debuginfo-1-4.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_36_1-debugsource-1-4.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_43_1-1-3.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_43_1-debuginfo-1-3.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_43_1-debugsource-1-3.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_49_1-1-2.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_49_1-debuginfo-1-2.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_49_1-debugsource-1-2.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_50_2-1-1.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_50_2-debuginfo-1-1.el9_0.x86_64.rpm
kpatch-patch-5_14_0-70_50_2-debugsource-1-1.el9_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-0386
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZEe/OdzjgjWX9erEAQgufQ//fDXSzoikL1jX2sZ9p8xKP9k1n7ddJZSa
uBwl7BJcsmZ6UxukTFGpgsHxzlw0fpwVWU9WJxgDkKXQ2SaqaL9GNWh1VAIZj2BQ
FGXi5FuBn3a0F8+vDzWApNlgnxhHspqHtT+duh2S5oPQ4OCF7ha2nzI34NCZDomx
xXp9RTblxIDYGgLwrBmaHhgJb2gddHJwQymADE1yi/qEdV9PmhAlJd1PozGkgrQW
WJU5wSP2Ppx6rCgkNSKdkG+DaCTqtK1HouBgsgAbvU0VqdFZSPjhb48sXZ7roe45
HesxY5ofH1ouKFwqWJPrkh0ra7nvSex1TWGXOjI+PMIoodDX5hb9Z7r1n7hz4/iI
ZIIYF2W9Gg/6Et/lU8Oi5UqVw17287UbsfMWWpwVcm+mfQmhkU584us74o1VtQg6
gAcU0yJE1MWPZrisQs+vNu2XHqX4Mdl5QyGU+mH6MjIQF2VDIYwhkbVPoyWdDnPH
fI5jBmcJcpeOB0svwett1Q3zv++LZaxkhJwqgDbPiRw2RxYsOkJf9BqK28Qz5RH0
hIz5/ayBz5xbAil7nivB4cSjhMilw+s17hwAMS7HtqEJQ4MUVYGbRJF+tEN5YP6h
nldlLV/ehbFuGTn03ZCHSsg898GiX0DwqARhgKbGpNPvK+aYQ5Kw6q4Vzfh9dVYl
qDiQifO1QgQ=3T1V
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
This Metasploit module exploit targets the Linux kernel bug in OverlayFS. A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Cybersecurity researchers have disclosed two high-severity security flaws in the Ubuntu kernel that could pave the way for local privilege escalation attacks. Cloud security firm Wiz, in a report shared with The Hacker News, said the easy-to-exploit shortcomings have the potential to impact 40% of Ubuntu users. "The impacted Ubuntu versions are prevalent in the cloud as they serve as the default
It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges. It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information. It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Various other issues were also addressed.
Ubuntu Security Notice 6134-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that the Traffic-Control Index implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 6072-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. Lin Ma discovered a race condition in the io_uring subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service.
Ubuntu Security Notice 6057-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.
Red Hat Security Advisory 2023-2104-01 - Red Hat Advanced Cluster Management for Kubernetes 2.5.8 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. Issues addressed include a denial of service vulnerability.
Red Hat Advanced Cluster Management for Kubernetes 2.6.5 General Availability release images, which fix bugs and security updates container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3841: A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage of this as the console API endpoint is missing an authentication check, allowing unauth...
Logging Subsystem 5.6.5 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-27539: A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpected amount of time, possibly resulting in a denial of service. * CVE-2023-28120: A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrus...
Red Hat Security Advisory 2023-1980-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
An update for kpatch-patch is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0386: A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges o...
Ubuntu Security Notice 6025-1 - It was discovered that the Traffic-Control Index implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.
An update for kpatch-patch is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0386: A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23521: A flaw was found in Git, a distributed revision control system. When parsing gitattributes, a mechanism to allow defining attributes for paths, multiple integer overflows can occur when there is a huge number of path patterns, attributes for a single pattern, ...
Red Hat Security Advisory 2023-1659-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel.
An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0266: A use-after-free flaw was found in snd_ctl_elem_read in sound/core/control.c in Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak problem. * CVE...
Red Hat Security Advisory 2023-1584-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-4269: A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of...
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0266: A use-after-free flaw was found in the ALSA subsystem in sound/core/control.c in the Linux kernel. This flaw allows a local attacker to cause a use-after-free issue. * CVE-2023-0386: A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux...