RHSA-2024:0412HighCVSS 8.8

Red Hat Security Advisory: kernel security and bug fix update

Published
January 25, 2024
Last Modified
October 14, 2026

🔗 CVE IDs covered (52)

CVE-2023-2162 →CVE-2023-3567 →CVE-2023-4732 →CVE-2023-31436 →CVE-2023-35823 →CVE-2022-50083 · pendingCVE-2023-1382 →CVE-2023-4623 →CVE-2023-5178 →CVE-2023-45871 →CVE-2022-30594 →CVE-2023-0394 →CVE-2023-1079 →CVE-2023-1195 →CVE-2023-1998 →CVE-2023-2163 →CVE-2023-42753 →CVE-2022-0854 →CVE-2022-3522 · pendingCVE-2022-3628 →CVE-2022-40982 →CVE-2022-47929 →CVE-2023-4622 →CVE-2022-3028 →CVE-2022-4129 →CVE-2022-20141 →CVE-2023-3611 →CVE-2023-3812 →CVE-2023-38409 →CVE-2023-53015 →CVE-2023-1073 →CVE-2023-23454 →CVE-2023-26545 →CVE-2023-35824 →CVE-2022-1679 →CVE-2022-43750 →CVE-2023-1192 →CVE-2023-1838 →CVE-2023-1855 →CVE-2023-2513 →CVE-2023-3268 →CVE-2023-3772 →CVE-2022-1016 →CVE-2022-3567 →CVE-2023-2194 →CVE-2023-3161 →CVE-2023-4459 →CVE-2023-33203 →CVE-2024-0562 →CVE-2022-41218 →CVE-2022-41858 →CVE-2022-50179 →

📋 Description

CVE-2022-0854 — kernel: swiotlb information leak with DMA_FROM_DEVICE CVE-2022-1016 — kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM CVE-2022-1679 — kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges CVE-2022-3028 — kernel: race condition in xfrm_probe_algs can lead to OOB read/write CVE-2022-3522 — kernel: race condition in hugetlb_no_page() in mm/hugetlb.c CVE-2022-3567 — kernel: data races around sk->sk_prot CVE-2022-3628 — kernel: USB-accessible buffer overflow in brcmfmac CVE-2022-4129 — kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference CVE-2022-20141 — kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets CVE-2022-30594 — kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option CVE-2022-40982 — hw: Intel: Gather Data Sampling (GDS) side channel vulnerability CVE-2022-41218 — kernel: Report vmalloc UAF in dvb-core/dmxdev CVE-2022-41858 — kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip CVE-2022-43750 — kernel: memory corruption in usbmon driver CVE-2022-47929 — kernel: NULL pointer dereference in traffic control subsystem CVE-2022-50083 — kernel: ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h CVE-2022-50179 — kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb CVE-2023-0394 — kernel: NULL pointer dereference in rawv6_push_pending_frames CVE-2023-1073 — kernel: HID: check empty report_list in hid_validate_values() CVE-2023-1079 — kernel: hid: Use After Free in asus_remove() CVE-2023-1192 — kernel: use-after-free in smb2_is_status_io_timeout() CVE-2023-1195 — kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c CVE-2023-1382 — kernel: denial of service in tipc_conn_close CVE-2023-1838 — kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() CVE-2023-1855 — kernel: use-after-free bug in remove function xgene_hwmon_remove CVE-2023-1998 — kernel: Spectre v2 SMT mitigations problem CVE-2023-2162 — kernel: UAF during login when accessing the shost ipaddress CVE-2023-2163 — kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe CVE-2023-2194 — kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() CVE-2023-2513 — kernel: ext4: use-after-free in ext4_xattr_set_entry() CVE-2023-3161 — kernel: fbcon: shift-out-of-bounds in fbcon_set_font() CVE-2023-3268 — kernel: out-of-bounds access in relay_file_read CVE-2023-3567 — kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race CVE-2023-3611 — kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead CVE-2023-3772 — kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() CVE-2023-3812 — kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags CVE-2023-4459 — kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() CVE-2023-4622 — kernel: use after free in unix_stream_sendpage CVE-2023-4623 — kernel: net/sched: sch_hfsc UAF CVE-2023-4732 — kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode BUG in include/linux/swapops.h CVE-2023-5178 — kernel: use after free in nvmet_tcp_free_crypto in NVMe CVE-2023-23454 — kernel: slab-out-of-bounds read vulnerabilities in cbq_classify CVE-2023-26545 — kernel: mpls: double free on sysctl allocation failure CVE-2023-31436 — kernel: out-of-bounds write in qfq_change_class function CVE-2023-33203 — kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() CVE-2023-35823 — kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() CVE-2023-35824 — kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() CVE-2023-38409 — kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment CVE-2023-42753 — kernel: netfilter: potential slab-out-of-bound access due to integer underflow CVE-2023-45871 — kernel: IGB driver inadequate buffer size for frames larger than MTU CVE-2023-53015 — kernel: HID: betop: check shape of output reports CVE-2024-0562 — kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c

🎯 Affected products132

  • Red Hat CodeReady Linux Builder EUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • bpftool-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • kernel-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-0:4.18.0-372.87.1.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-abi-stablelists-0:4.18.0-372.87.1.el8_6.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-core-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-core-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-core-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-core-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-debug-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-debug-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-debug-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-debug-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • kernel-debug-core-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.6)
  • +102 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: On non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent the module ath9k from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, prevent the brcmfmac module from being loaded. See https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: If ptrace is not required, ptrace can be disabled in multiple ways. 1. SELinux policy. # setsebool -P deny_ptrace on 2. Kernel sysctl. # sysctl -w kernel.yama.ptrace_scope=3 Or to make persistent , create /etc/sysctl.d/99-yama-ptrace_scope.conf kernel.yama.ptrace_scope=3 If you need further assistance, see the KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. Workaround: The vulnerability can be mitigated by installing the CPU microcode package microcode_ctl version 20230808. Workaround: To mitigate this issue, prevent the module dvb-core from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: This flaw can be mitigated by preventing the affected slip driver from loading during the boot time, and ensuring the module is added to the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: ``` # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf ``` Workaround: This flaw can be mitigated by preventing the affected ASUS HID driver (for notebook built-in keyboard) module from loading during the boot time, ensure the module is added into the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: This flaw can be mitigated by preventing the affected transparent inter-process communication (TIPC) protocol kernel module from loading during the boot time. Ensure the module is added into the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: This flaw can be mitigated by preventing the affected Host kernel accelerator (vhost-net) kernel module from loading during the boot time, ensure the module is added to the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: This flaw can be mitigated by preventing the affected APM X-Gene SoC HW monitor kernel driver (apm_xgene) from loading during the boot time. Ensure the module is added into the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt. Workaround: This flaw can be mitigated by preventing the affected iscsi_tcp.ko kernel module from loading during the boot time, ensure the module is added into the blacklist file. ~~~ Refer: How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. Workaround: This flaw can be mitigated by preventing the i2c-xgene-slimpro module from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from being loaded automatically. Workaround: Mitigation for this issue is to skip loading the affected module sch_qfq onto the system until we have a fix available. This can be done by a blacklist mechanism and will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: To mitigate this issue, prevent the tun module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: In order to mitigate this issue, prevent the affected code from being loaded by blacklisting the kernel module "vmxnet3". For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 ~~~ Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace. ~~~ Workaround: Mitigation for this issue is either not available or currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, prevent the module sch_hfsc from being loaded by blacklisting the module to prevent it from loading automatically. ~~~ https://access.redhat.com/solutions/41278 ~~~ Workaround: A possible workaround is disabling Transparent Hugepage Workaround: The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: ``` # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf ``` It is also possible to prevent the affected code from being loaded by blacklisting the `cbq` kernel module. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278. Workaround: To mitigate this issue, prevent the module, sch_qfq from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is to skip loading the affected module "fbcon" o…

🔗 References (54)