RHSA-2024:2093MediumCVSS 7.8

Red Hat Security Advisory: security update Logging for Red Hat OpenShift - 5.7.13

Published
May 1, 2024
Last Modified
August 6, 2026

🔗 CVE IDs covered (12)

CVE-2021-43618 →CVE-2022-48624 →CVE-2023-6546 →CVE-2023-28322 →CVE-2023-51042 →CVE-2024-1086 →CVE-2021-33631 →CVE-2022-38096 →CVE-2023-6931 →CVE-2023-38546 →CVE-2023-46218 →CVE-2024-0565 →

📋 Description

CVE-2021-33631 — kernel: ext4: kernel bug in ext4_write_inline_data_end() CVE-2021-43618 — gmp: Integer overflow and resultant buffer overflow via crafted input CVE-2022-38096 — kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query CVE-2022-48624 — less: missing quoting of shell metacharacters in LESSCLOSE handling CVE-2023-6546 — kernel: GSM multiplexing race condition leads to privilege escalation CVE-2023-6931 — kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size CVE-2023-28322 — curl: more POST-after-PUT confusion CVE-2023-38546 — curl: cookie injection with none file CVE-2023-46218 — curl: information disclosure by exploiting a mixed case flaw CVE-2023-51042 — kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c CVE-2024-0565 — kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client CVE-2024-1086 — kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function

🎯 Affected products64

  • RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-operator-bundle@sha256:5052bba9c7eba5ad23b72f73429ecdbc2de555d9138a2d77ec271297b5030ffd_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:2c8e5b01f778d0c79cd5dd94476fca3c67f540c234735c9511c5a84fc08aab99_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:47f59d32139e8d738e1916321c52842e62f79724334c6af50ce988e283aa0a99_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:61c2a4170defd4022aa103f89394cb759fa349e7c146506f4c247e67b3b12c01_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:e3da1a9825779d34882915353603bca4fb66accdd45aa9acc92ed2fe694071cd_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-operator-bundle@sha256:e7473220ed7c90e9828fa9f20ca7b5365abcceec9e0deb23ccd7fb1d59557457_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:16774c5a92ee7c8a5c841badba97b346cc1bdfb34b776331177ccea7d1967b5e_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:25f30f718ad1ff34d4658aa14c86eaac26f973d42d736f65fa68ab23d2256439_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:cfbaf603982debbd682ef4a5d5e2b8309c43e6db519699e793f55f4433d13327_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:ec87f5708c1726a86cd075f1eb0c7c8f272e18311e898481282f29bb63189d26_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:2ec1ae08dd2f29a777d71003ae0d2a69eb56ad6e10742706ac35784faf45c08d_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:9c4d1c2beb0248c2f518e1e936298bfb9c9a22f87e2cbacd501cdaef675850e2_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:b884874a18a66126d49de1d0c253247b87371dc027f1d96b5615fbeb0adaa7b5_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:c3f5921db6798608847173f2c6049f7a6bec470ead8aea936c13fb5348e6192a_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:0c04dbc3a45a08de0f6e53605c8e9db1fae051053dc524a70bf6d99746667a60_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:44989bd7b7fe369ff2f3ba62b5db4d264b0a86d8cfccd96b720d74d50e9a4910_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:68453af0ac957b708b8972162a4e5382f2ec30fa6de79caf013ee876c2008654_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:add0ccfb34e3f0798db0f544bdbc080706611b506eaa24fe8b39a369fba1af7c_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:33b90ea96d93fcc73e740227aa755d85e18566654668f89928572126d80535fe_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:7668e3265f4372a0d45342948ce1630e73cd88318e7fce7d720a685a3b240ece_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:9ce55848e6d84082724ef735fd373726fdecf0935fc42061358a2704c405a3d5_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:9f4432fa50935c4d18ae0b9a4da00bf82336347700d1a09643d6597247e1f2f9_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:25a5133ec301b3334446ccd2205d20209aaf246544b5c11d01f6b1b8885da046_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:2a441a5b9d9ca81a769af0bf89245f437f3156b654ed25afa885960567166b9d_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:451c1497aa3e26d72a165923d36bbbec4a1ba6536f6ca1fab227467aae21bab6_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:f1b69daf30586538e51e61165ddb5c91d51524d6a020a6392955b726bfc9b1e4_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:3cfae28317e8fa0d73f66626827aa16e8b98b9e8961007b3aa1d4fa30ab663e6_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:80fc28564f2bb7d5324997722497a5a64db13b9a92c93e632323168b9ef12afc_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:bb7addc37488f89ac93564dea9d76e3778eaa421206db72236d8aeb56195878a_amd64 as a component of RHOL 5.7 for RHEL 8
  • +34 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html For Red Hat OpenShift Logging 5.7, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.12/logging/cluster-logging-upgrading.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, it is possible to prevent the affected code from being loaded by blacklisting the vmwgfx kernel module. For instructions relating to blacklisting a kernel module, please see https://access.redhat.com/solutions/41278. Workaround: This flaw can be mitigated by preventing the affected `n_gsm` kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278. Workaround: It is not possible to trigger this issue with the default kernel.perf_event_paranoid sysctl value 2. You may check it with: cat /proc/sys/kernel/perf_event_paranoid Workaround: To mitigate this issue, prevent the amdgpu module from loading. Please see https://access.redhat.com/solutions/41278 for more information on how to prevent kernel modules from loading. Note that if a system has an AMD GPU, this may make certain features of that GPU unavailable. Workaround: To mitigate this issue, prevent module cifs from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: 1. This flaw can be mitigated by preventing the affected netfilter (nf_tables) kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278. 2. If the module cannot be disabled, on non-containerized deployments of Red Hat Enterprise Linux, the mitigation is to disable user namespaces: ``` # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf ``` On containerized deployments, such as Red Hat OpenShift Container Platform, do not use the second mitigation (disabling user namespaces) as the functionality is needed to be enabled. The first mitigation (blacklisting nf_tables) is still viable for containerized deployments, providing the environment is not using netfilter.

🔗 References (8)