Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:7344: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2022-2588: kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation
Red Hat Security Data
#vulnerability#web#linux#red_hat#nodejs#js#java#kubernetes#aws#rpm

Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager

All Products

Issued:

2022-11-02

Updated:

2022-11-02

RHSA-2022:7344 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: kpatch-patch security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for kpatch-patch is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel.

Security Fix(es):

  • a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

  • BZ - 2114849 - CVE-2022-2588 kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation

Red Hat Enterprise Linux Server 7

SRPM

kpatch-patch-3_10_0-1160_62_1-1-3.el7.src.rpm

SHA-256: 8227746d9d321d1173e8caf124f7e9506f8f91ee1761721bc01b9485756e2d75

kpatch-patch-3_10_0-1160_66_1-1-2.el7.src.rpm

SHA-256: 58051d63d16c25a449d1be8cc199ce00e5f41d135bd6c97f797c22c7f2a1d464

kpatch-patch-3_10_0-1160_71_1-1-1.el7.src.rpm

SHA-256: 797409cd2ccc301bd2002cbcd3ed92277445bd5c9f87ab19cbcc2be81bf78c92

kpatch-patch-3_10_0-1160_76_1-1-1.el7.src.rpm

SHA-256: 4fb7fe07b8c54f13601820c6ddf380cc6f9909bdbf6a8414d4e33080aaba880c

x86_64

kpatch-patch-3_10_0-1160_62_1-1-3.el7.x86_64.rpm

SHA-256: 1fd1b835efaca87ab92e279516b2661da01c3d32fbef027aa12e39a1d555f5ad

kpatch-patch-3_10_0-1160_62_1-debuginfo-1-3.el7.x86_64.rpm

SHA-256: 54dc9e335abc3c549882c9fb081da8252023a6e2864115bfe0d2b735e72f1069

kpatch-patch-3_10_0-1160_66_1-1-2.el7.x86_64.rpm

SHA-256: 164a6952c3b6b657726c1c4cdc63defe2e74110616060c1a9b8311972c317406

kpatch-patch-3_10_0-1160_66_1-debuginfo-1-2.el7.x86_64.rpm

SHA-256: b4833e84cb8256d7ecc3505b9a9c5d5a91df7d8f0539bad5b044b673b5f9aabb

kpatch-patch-3_10_0-1160_71_1-1-1.el7.x86_64.rpm

SHA-256: e9327a902cb23627747fa5cb0cc6a1373249202bd1d98e033e53e1c9da62f3c5

kpatch-patch-3_10_0-1160_71_1-debuginfo-1-1.el7.x86_64.rpm

SHA-256: 53e03c2efdc41c95fd3a258995bd188d0cb14674fb802553e59e1cd0aeb477bb

kpatch-patch-3_10_0-1160_76_1-1-1.el7.x86_64.rpm

SHA-256: 084cba62c76e2857f142a4da006b5c388c12702cacebe4e25c08f4b0f8049819

kpatch-patch-3_10_0-1160_76_1-debuginfo-1-1.el7.x86_64.rpm

SHA-256: c45dee681ca37aabd4c9a5b3de7a7980657f461a25a316f5b3b8dfb243fd8736

Red Hat Enterprise Linux for Power, little endian 7

SRPM

kpatch-patch-3_10_0-1160_62_1-1-3.el7.src.rpm

SHA-256: 8227746d9d321d1173e8caf124f7e9506f8f91ee1761721bc01b9485756e2d75

kpatch-patch-3_10_0-1160_66_1-1-2.el7.src.rpm

SHA-256: 58051d63d16c25a449d1be8cc199ce00e5f41d135bd6c97f797c22c7f2a1d464

kpatch-patch-3_10_0-1160_71_1-1-1.el7.src.rpm

SHA-256: 797409cd2ccc301bd2002cbcd3ed92277445bd5c9f87ab19cbcc2be81bf78c92

kpatch-patch-3_10_0-1160_76_1-1-1.el7.src.rpm

SHA-256: 4fb7fe07b8c54f13601820c6ddf380cc6f9909bdbf6a8414d4e33080aaba880c

ppc64le

kpatch-patch-3_10_0-1160_62_1-1-3.el7.ppc64le.rpm

SHA-256: d9a0ec216ed7b8fdb8f4fb7eac8697ec2005eaa8e4582e0468b3f987df41c86b

kpatch-patch-3_10_0-1160_62_1-debuginfo-1-3.el7.ppc64le.rpm

SHA-256: d9a46fa238257a83c07094919fb93c42dbce4e11973d5bd3027824fe9dea4360

kpatch-patch-3_10_0-1160_66_1-1-2.el7.ppc64le.rpm

SHA-256: 1b5757bf324add9b0e90a36c09054ae8ce8d89b00c2f010d0f255f569c935f2e

kpatch-patch-3_10_0-1160_66_1-debuginfo-1-2.el7.ppc64le.rpm

SHA-256: 7addf218fa2948e559a15718eccf169965a7a1e5d9982e13cfdce2b494df3eff

kpatch-patch-3_10_0-1160_71_1-1-1.el7.ppc64le.rpm

SHA-256: e5bfd2c44644ef818b9b565efabac0a424d5cc31a26e7090eae596a16b68b5cc

kpatch-patch-3_10_0-1160_71_1-debuginfo-1-1.el7.ppc64le.rpm

SHA-256: 84bade25b400643b40f455941fa512040bc6396a3f8eb274bb80f7c92abdf641

kpatch-patch-3_10_0-1160_76_1-1-1.el7.ppc64le.rpm

SHA-256: 87219c226cf983c01a50adb947436e037f176a916ce5bcc748050c42b0772872

kpatch-patch-3_10_0-1160_76_1-debuginfo-1-1.el7.ppc64le.rpm

SHA-256: d9ddf4cb11813b5f438dca00dd76cc636bf6668999e1c72195642304c4d2c285

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

Red Hat Security Advisory 2023-4022-01

Red Hat Security Advisory 2023-4022-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include double free, privilege escalation, and use-after-free vulnerabilities.

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

Red Hat Security Advisory 2022-7874-01

Red Hat Security Advisory 2022-7874-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.8.53. Issues addressed include a code execution vulnerability.

RHSA-2022:7434: Red Hat Security Advisory: Logging Subsystem 5.5.4 - Red Hat OpenShift security update

Logging Subsystem 5.5.4 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-32149: golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags

RHSA-2022:7885: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2588: kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation

Red Hat Security Advisory 2022-7313-01

Red Hat Security Advisory 2022-7313-01 - Red Hat Advanced Cluster Management for Kubernetes 2.6.2 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Issues addressed include denial of service and remote SQL injection vulnerabilities.

RHSA-2022:7279: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2588: kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation * CVE-2022-21123: hw: cpu: Incomplete cleanup of multi-core shared buffers (aka S...

Red Hat Security Advisory 2022-7173-01

Red Hat Security Advisory 2022-7173-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include privilege escalation and use-after-free vulnerabilities.

Red Hat Security Advisory 2022-7110-01

Red Hat Security Advisory 2022-7110-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include code execution, information leakage, memory leak, privilege escalation, and use-after-free vulnerabilities.

RHSA-2022:7173: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-3715: kernel: use-after-free in route4_change() in net/sched/cls_route.c * CVE-2022-2588: kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation

RHSA-2022:7110: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-0494: kernel: information leak in scsi_ioctl() * CVE-2022-1353: Kernel: A kernel-info-leak issue in pfkey_register * CVE-2022-2588: kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation * CVE-2022-23816: hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions * CVE-2022-23825: hw: cpu:...

CVE-2022-38108: Published | Zero Day Initiative

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

CVE-2022-41686: en/security-disclosure/2022/2022-10.md · OpenHarmony/security - Gitee.com

OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have an Out-of-bound memory read and write vulnerability in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory leading sensitive to information disclosure. The processes with system user UID run on the device would be able to write out-of-bound memory which could lead to unspecified memory corruption.

RHSA-2022:6551: Red Hat Security Advisory: Red Hat Virtualization security update

An update for redhat-release-virtualization-host, redhat-virtualization-host, and redhat-virtualization-host-productimg is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1012: kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak * CVE-2022-2132: dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs * CVE-2022-...

Ubuntu Security Notice USN-5567-1

Ubuntu Security Notice 5567-1 - Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service or execute arbitrary code. It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or execute arbitrary code.

Ubuntu Security Notice USN-5565-1

Ubuntu Security Notice 5565-1 - Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service or execute arbitrary code. It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or execute arbitrary code.