RHSA-2024:1248HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
March 12, 2024
Last Modified
July 28, 2026

🔗 CVE IDs covered (11)

CVE-2023-6817 →CVE-2023-51042 →CVE-2024-0646 →CVE-2023-5717 →CVE-2023-6535 →CVE-2023-6606 →CVE-2024-0193 →CVE-2023-4244 →CVE-2023-6356 →CVE-2023-6536 →CVE-2023-6610 →

📋 Description

CVE-2023-4244 — kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction CVE-2023-5717 — kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list CVE-2023-6356 — kernel: NULL pointer dereference in nvmet_tcp_build_iovec CVE-2023-6535 — kernel: NULL pointer dereference in nvmet_tcp_execute_request CVE-2023-6536 — kernel: NULL pointer dereference in __nvmet_req_complete CVE-2023-6606 — kernel: Out-Of-Bounds Read vulnerability in smbCalcSize CVE-2023-6610 — kernel: OOB Access in smb2_dump_detail CVE-2023-6817 — kernel: inactive elements in nft_pipapo_walk CVE-2023-51042 — kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c CVE-2024-0193 — kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation CVE-2024-0646 — kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

🎯 Affected products200

  • Red Hat CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • bpftool-0:7.2.0-362.24.1.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.2.0-362.24.1.el9_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.2.0-362.24.1.el9_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.2.0-362.24.1.el9_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • bpftool-debuginfo-0:7.2.0-362.24.1.el9_3.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-362.24.1.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-362.24.1.el9_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-362.24.1.el9_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-362.24.1.el9_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-362.24.1.el9_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-362.24.1.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-362.24.1.el9_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Mitigation for this issue is to skip loading the affected module "nftables" onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: It is not possible to trigger this issue with the default kernel.perf_event_paranoid sysctl value 2. You may check it with: cat /proc/sys/kernel/perf_event_paranoid Workaround: To mitigate this issue, prevent module nvmet-tcp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent module cifs from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent the amdgpu module from loading. Please see https://access.redhat.com/solutions/41278 for more information on how to prevent kernel modules from loading. Note that if a system has an AMD GPU, this may make certain features of that GPU unavailable. Workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (14)