RHSA-2023:5093HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch security update

Published
September 12, 2023
Last Modified
October 15, 2026

🔗 CVE IDs covered (7)

CVE-2023-4147 →CVE-2023-31248 →CVE-2023-35001 →CVE-2023-3390 →CVE-2023-3610 →CVE-2023-3776 →CVE-2023-4004 →

📋 Description

CVE-2023-3390 — kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests CVE-2023-3610 — kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE CVE-2023-3776 — kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function CVE-2023-4004 — kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() CVE-2023-4147 — kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free CVE-2023-31248 — kernel: nf_tables: use-after-free in nft_chain_lookup_byid() CVE-2023-35001 — kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()

🎯 Affected products22

  • Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-0:1-5.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-0:1-5.el9_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-0:1-5.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-debuginfo-0:1-5.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-debuginfo-0:1-5.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-debugsource-0:1-5.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_11_1-debugsource-0:1-5.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-0:1-4.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-0:1-4.el9_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-0:1-4.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-debuginfo-0:1-4.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-debuginfo-0:1-4.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-debugsource-0:1-4.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_18_1-debugsource-0:1-4.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-0:1-3.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-0:1-3.el9_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-0:1-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-debuginfo-0:1-3.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-debuginfo-0:1-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-debugsource-0:1-3.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-284_25_1-debugsource-0:1-3.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent module cls_fw from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: This flaw can be mitigated by preventing the affected netfilter kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278. Workaround: To mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the kernel netfilter module. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278

🔗 References (10)