What is RHSA-2023:5575?

RHSA-2023:5575 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: kpatch-patch security update

Which CVE IDs does RHSA-2023:5575 cover?

RHSA-2023:5575 covers the following CVE IDs: CVE-2023-4128, CVE-2023-31248, CVE-2023-35001, CVE-2023-35788. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2023:5575?

RHSA-2023:5575 has a CVSS v3 base score of 7.8, published by Red Hat Product Security.

Which products are affected by RHSA-2023:5575?

RHSA-2023:5575 affects 43 products, including: Red Hat Enterprise Linux BaseOS EUS (v.9.0); kpatch-patch-5_14_0-70_49_1-0:1-6.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0); kpatch-patch-5_14_0-70_49_1-0:1-6.el9_0.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0); kpatch-patch-5_14_0-70_49_1-0:1-6.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0); kpatch-patch-5_14_0-70_49_1-debuginfo-0:1-6.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0); and others — see the full list on the advisory page.

RHSA-2023:5575HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch security update

Vendor

Red Hat Product Security

Published

October 10, 2023

Last Modified

October 15, 2026

🔗 CVE IDs covered (4)

CVE-2023-4128 · pendingCVE-2023-31248 →CVE-2023-35001 →CVE-2023-35788 →

📋 Description

CVE-2023-4128 — kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route CVE-2023-31248 — kernel: nf_tables: use-after-free in nft_chain_lookup_byid() CVE-2023-35001 — kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() CVE-2023-35788 — kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()

🎯 Affected products43

Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-0:1-6.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-0:1-6.el9_0.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-0:1-6.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-debuginfo-0:1-6.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-debuginfo-0:1-6.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-debugsource-0:1-6.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_49_1-debugsource-0:1-6.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-0:1-5.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-0:1-5.el9_0.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-0:1-5.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-debuginfo-0:1-5.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-debuginfo-0:1-5.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-debugsource-0:1-5.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_50_2-debugsource-0:1-5.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-0:1-4.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-0:1-4.el9_0.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-0:1-4.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-debuginfo-0:1-4.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-debuginfo-0:1-4.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-debugsource-0:1-4.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_53_1-debugsource-0:1-4.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-0:1-3.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-0:1-3.el9_0.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-0:1-3.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-debuginfo-0:1-3.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-debuginfo-0:1-3.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-debugsource-0:1-3.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_58_1-debugsource-0:1-3.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
kpatch-patch-5_14_0-70_64_1-0:1-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.0)
+13 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the kernel netfilter module. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 Workaround: This flaw can be mitigated by preventing the affected `cls_flower` kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.

🔗 CVE IDs covered (4)

📋 Description

🎯 Affected products43

✅ Remediation

🔗 References (7)