RHSA-2021:4140MediumCVSS 7.8

Red Hat Security Advisory: kernel-rt security and bug fix update

Published
November 9, 2021
Last Modified
August 5, 2026

🔗 CVE IDs covered (46)

CVE-2021-20194 →CVE-2021-28950 →CVE-2020-0427 →CVE-2020-26147 →CVE-2020-29660 →CVE-2020-36386 →CVE-2021-29155 →CVE-2021-29650 →CVE-2021-31829 →CVE-2022-20166 →CVE-2019-14615 →CVE-2020-24503 →CVE-2020-26145 →CVE-2020-26146 →CVE-2020-29368 →CVE-2020-36312 →CVE-2021-3564 →CVE-2021-3679 →CVE-2020-24586 →CVE-2021-0129 →CVE-2021-3600 →CVE-2021-3659 →CVE-2021-23133 →CVE-2021-29646 →CVE-2021-31916 →CVE-2021-33200 →CVE-2020-26140 →CVE-2021-3573 →CVE-2021-20239 →CVE-2021-33033 →CVE-2020-24504 →CVE-2020-26139 →CVE-2020-26144 →CVE-2021-28971 →CVE-2020-24587 →CVE-2020-24588 →CVE-2020-26141 →CVE-2021-3732 →CVE-2021-46905 →CVE-2021-31440 →CVE-2020-24502 →CVE-2020-26143 →CVE-2020-36158 →CVE-2021-3348 →CVE-2021-3489 →CVE-2021-3635 →

📋 Description

CVE-2019-14615 — kernel: Intel graphics card information leak. CVE-2020-0427 — kernel: out-of-bounds reads in pinctrl subsystem. CVE-2020-24502 — kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers CVE-2020-24503 — kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers CVE-2020-24504 — kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers CVE-2020-24586 — kernel: Fragmentation cache not cleared on reconnection CVE-2020-24587 — kernel: Reassembling fragments encrypted under different keys CVE-2020-24588 — kernel: wifi frame payload being parsed incorrectly as an L2 frame CVE-2020-26139 — kernel: Forwarding EAPOL from unauthenticated wifi client CVE-2020-26140 — kernel: accepting plaintext data frames in protected networks CVE-2020-26141 — kernel: not verifying TKIP MIC of fragmented frames CVE-2020-26143 — kernel: accepting fragmented plaintext frames in protected networks CVE-2020-26144 — kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header CVE-2020-26145 — kernel: accepting plaintext broadcast fragments as full frames CVE-2020-26146 — kernel: reassembling encrypted fragments with non-consecutive packet numbers CVE-2020-26147 — kernel: reassembling mixed encrypted/plaintext fragments CVE-2020-29368 — kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check CVE-2020-29660 — kernel: locking inconsistency in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c can lead to a read-after-free CVE-2020-36158 — kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function in drivers/net/wireless/marvell/mwifiex/join.c via a long SSID value CVE-2020-36312 — kernel: memory leak upon a kmalloc failure in kvm_io_bus_unregister_dev function in virt/kvm/kvm_main.c CVE-2020-36386 — kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() in net/bluetooth/hci_event.c CVE-2021-0129 — kernel: Improper access control in BlueZ may allow information disclosure vulnerability. CVE-2021-3348 — kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c CVE-2021-3489 — kernel: Linux kernel eBPF RINGBUF map oversized allocation CVE-2021-3564 — kernel: double free in bluetooth subsystem when the HCI device initialization fails CVE-2021-3573 — kernel: use-after-free in function hci_sock_bound_ioctl() CVE-2021-3600 — kernel: eBPF 32-bit source register truncation on div/mod CVE-2021-3635 — kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 CVE-2021-3659 — kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c CVE-2021-3679 — kernel: DoS in rb_per_cpu_empty() CVE-2021-3732 — kernel: overlayfs: Mounting overlayfs inside an unprivileged user namespace can reveal files CVE-2021-20194 — kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() CVE-2021-20239 — kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure CVE-2021-23133 — kernel: Race condition in sctp_destroy_sock list_del CVE-2021-28950 — kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode CVE-2021-28971 — kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c CVE-2021-29155 — kernel: protection for sequences of pointer arithmetic operations against speculatively out-of-bounds loads can be bypassed to leak content of kernel memory CVE-2021-29646 — kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c CVE-2021-29650 — kernel: lack a full memory barrier upon the assignment of a new table value in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h may lead to DoS CVE-2021-31440 — kernel: local escalation of privileges in handling of eBPF programs CVE-2021-31829 — kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content of kernel memory CVE-2021-31916 — kernel: out of bounds array access in drivers/md/dm-ioctl.c CVE-2021-33033 — kernel: use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c CVE-2021-33200 — kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier CVE-2021-46905 — kernel: NULL-deref on disconnect regression CVE-2022-20166 — kernel: possible buffer overflow in sysfs reading

🎯 Affected products32

  • Red Hat Enterprise Linux Real Time (v. 8)
  • Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-0:4.18.0-348.rt7.130.el8.src as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-0:4.18.0-348.rt7.130.el8.src as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-core-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-core-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debug-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-core-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debug-core-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-kvm-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-devel-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-devel-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-kvm-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)
  • kernel-rt-modules-0:4.18.0-348.rt7.130.el8.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)
  • +2 more not shown

✅ Remediation

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Preventing loading of the i915 kernel module will prevent attackers from using this exploit against the system; however, the power management functionality of the card will be disabled and the system may draw additional power. See the kcs “How do I blacklist a kernel module to prevent it from loading automatically?“ (https://access.redhat.com/solutions/41278) for instructions on how to disable a kernel module from autoloading. Graphical displays may also be at low resolution or not work correctly. This mitigation may not be suitable if the graphical login functionality is required. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, prevent the module mwifiex from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent the module bluetooth from being loaded (if Bluetooth not required for the system). Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent the module nbd from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising easThe required privileges is CAP_NET_ADMIN capabilities. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.e of use and deployment, applicability to widespread installation base or stability. Workaround: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities. Workaround: To mitigate this issue, prevent the module mac802154 from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF. Workaround: Loading a filter is a privileged (CAP_SYS_ADMIN or root) operation. Once any filter is used, this attack is capable of being used by an unprivileged user. There is no known mitigation that product security finds suitable for this flaw. Workaround: To mitigate this issue, prevent the module sctp from being loaded (and this is so by default for Red Hat Enterprise Linux 8). Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically. Workaround: As the FUSE module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: # echo "install fuse /bin/true" >> /etc/modprobe.d/disable-fuse.conf The system will need to be restarted if the FUSE modules are loaded. In most circumstances, the CIFS kernel modules will be unable to be unloaded while the FUSE filesystems are in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. Workaround: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 7 and 8 kernel to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities. Workaround: The mitigation would be not allowing CIPSO labeling for the inbound network connections. For the most of the default configurations both for network routers and for the Linux servers itself it is disabled by default.

🔗 References (48)