RHSA-2024:2094MediumCVSS 7.8

Red Hat Security Advisory: security update Logging for Red Hat OpenShift - 5.8.6

Published
May 1, 2024
Last Modified
July 28, 2026

🔗 CVE IDs covered (16)

CVE-2023-6535 →CVE-2023-6817 →CVE-2023-51042 →CVE-2024-0646 →CVE-2023-6610 →CVE-2024-0553 →CVE-2023-5363 →CVE-2023-6606 →CVE-2023-46218 →CVE-2024-0193 →CVE-2024-0567 →CVE-2023-4244 →CVE-2023-5717 →CVE-2023-5981 →CVE-2023-6536 →CVE-2023-6356 →

📋 Description

CVE-2023-4244 — kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction CVE-2023-5363 — openssl: Incorrect cipher key and IV length processing CVE-2023-5717 — kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list CVE-2023-5981 — gnutls: timing side-channel in the RSA-PSK authentication CVE-2023-6356 — kernel: NULL pointer dereference in nvmet_tcp_build_iovec CVE-2023-6535 — kernel: NULL pointer dereference in nvmet_tcp_execute_request CVE-2023-6536 — kernel: NULL pointer dereference in __nvmet_req_complete CVE-2023-6606 — kernel: Out-Of-Bounds Read vulnerability in smbCalcSize CVE-2023-6610 — kernel: OOB Access in smb2_dump_detail CVE-2023-6817 — kernel: inactive elements in nft_pipapo_walk CVE-2023-46218 — curl: information disclosure by exploiting a mixed case flaw CVE-2023-51042 — kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c CVE-2024-0193 — kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation CVE-2024-0553 — gnutls: incomplete fix for CVE-2023-5981 CVE-2024-0567 — gnutls: rejects certificate chain with distributed trust CVE-2024-0646 — kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

🎯 Affected products60

  • RHOL 5.8 for RHEL 9
  • openshift-logging/cluster-logging-operator-bundle@sha256:b8f7447cea88a30d89bc8ade1f5ff5141f622be6a243cb5528a7375a211691fb_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:29e258c3adcf75769a677a6b2b9686e41805d92eb28e13588037daf6b419c13d_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:5c9d3102b85af98e2d8151deac91f847bae3dedd7732e2b38bdd245fa7d9337f_arm64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:77b893f09078e9c5c2b8522a12fbbd954bde9fb7baaef556f02e01ba1b880935_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/cluster-logging-rhel9-operator@sha256:f0cc599e5f50d8b04c03cf0dc0ce7a348c5b2b44ecdce12b4517f06d27fafc65_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-operator-bundle@sha256:2f1f1bc490563ad977eb7401ffa466c013568cac2b35550973c6abe5975afd5e_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-proxy-rhel9@sha256:7744caeeda9acb7ad9656e0aed23d38d23101251639883726382d87d04e520b1_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-proxy-rhel9@sha256:d27f9b4a659dffe0084179c8f92b398c337a9e841e650363f085a1ddb2dcd203_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-proxy-rhel9@sha256:d9df76db2855ff0ee7c3c9a0e938b8979b3b09a5adf38d6b4cf50079303fac6e_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-proxy-rhel9@sha256:da939e3767a4830e6a9552f0a563c4ea5aa4dd28fb2e19a0f37f5878dce89785_arm64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-rhel9-operator@sha256:6ed6865ece2a53ca24ea9389d0f282b0d5f5653d635b4e356d979d2ebd9a7426_arm64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-rhel9-operator@sha256:a8ffedee4a3e56014514b05034485c4e67b8dd819a4252d393e2a48d580c832d_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-rhel9-operator@sha256:c72a7a38b007a321ea19b9aa18bd30b3e746b5bac4e0013e4bd1edc3f01e5b3c_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch-rhel9-operator@sha256:ec3ce9aef0917ed4e1a691655191edafd0f974acfe5d0ab86d7d2b8f177b9dba_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch6-rhel9@sha256:3f4ea6c7d4ddf93325a7464fc36098ae88c583cc909dfe5ab97f63b1d2aa0f6a_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch6-rhel9@sha256:5c06e3d1f8ce8463cb5fda103e52cf189939dcf3ef42a59ff9bc65dfc552afd3_arm64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch6-rhel9@sha256:a56f7a31e4beec80940ce58477ee03d0acc97eb924930ced3831febf7b342812_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/elasticsearch6-rhel9@sha256:dd19b9602d8a8d53baab2af94ea35d577b0459676af8231078f88ba464034e3c_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:0a469314bddded3df4b7e686e3c4ad39dd043ae2b56c1fdc7162f1f404336439_arm64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:81bac8525a2ed6566724c0cd80c9afa101aa257c57860e31bae3d644b5b5557d_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:a1178e24b5106fa48f0f8b0ea5d18e859ebe87118feb04667cd6d85f37f72c98_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/eventrouter-rhel9@sha256:cb47d5023a3752f94bbeaaf7a153b98c955ee7762ec5acbcda40635524c91c6c_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:4f27498a88603d313b9f238d0736ce1683dbf5bd64c426526f28512ec5e8582f_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:8e63d64e2afcf8691c1a77c364ededa57e4769f633d51958995c0e6427b264fa_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:e2042d6109b060ebe77fd7b5352293d627e9cef14a996510c8f87d5ca8292743_arm64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/fluentd-rhel9@sha256:ff1fa24f96891ed3c741268103279113b2fa08abfac0498f2cb20e36fd2440cf_amd64 as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:3284deb724dc856f40a72643f1e535e47ef32cc3ca5cf5c6469ce0de4a8a3015_s390x as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:5a520e94f3b447c2c7b05ed4cd15e7fa64564133973131218c9406f5733e4ca7_ppc64le as a component of RHOL 5.8 for RHEL 9
  • openshift-logging/log-file-metric-exporter-rhel9@sha256:a30d28293139541892e8871e7f631d799f0ac6fb5924c3d933dffaa64ac83daf_arm64 as a component of RHOL 5.8 for RHEL 9
  • +30 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html For Red Hat OpenShift Logging 5.8, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html Workaround: Mitigation for this issue is to skip loading the affected module "nftables" onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: It is not possible to trigger this issue with the default kernel.perf_event_paranoid sysctl value 2. You may check it with: cat /proc/sys/kernel/perf_event_paranoid Workaround: To address the issue found upgrade to GnuTLS 3.8.2 or later versions. Workaround: To mitigate this issue, prevent module nvmet-tcp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent module cifs from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent the amdgpu module from loading. Please see https://access.redhat.com/solutions/41278 for more information on how to prevent kernel modules from loading. Note that if a system has an AMD GPU, this may make certain features of that GPU unavailable. Workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (8)