RHSA-2024:4352HighCVSS 7.0

Red Hat Security Advisory: kernel-rt security and bug fix update

Published
July 8, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (58)

CVE-2023-52626 →CVE-2024-35959 →CVE-2021-47311 →CVE-2023-52464 →CVE-2023-52615 →CVE-2023-52667 →CVE-2023-52700 →CVE-2024-36007 →CVE-2021-47353 →CVE-2023-52560 →CVE-2024-35888 →CVE-2024-35958 →CVE-2021-47236 →CVE-2023-52813 →CVE-2023-52835 →CVE-2024-26906 →CVE-2024-26974 →CVE-2021-47310 →CVE-2023-52877 →CVE-2024-26656 →CVE-2024-26982 →CVE-2024-35890 →CVE-2024-35960 →CVE-2021-47495 →CVE-2023-52881 →CVE-2024-27410 →CVE-2024-27397 →CVE-2024-35838 →CVE-2021-46909 →CVE-2021-47073 →CVE-2024-26583 →CVE-2024-26759 →CVE-2024-26907 →CVE-2024-35835 →CVE-2024-35854 →CVE-2024-35855 →CVE-2024-26584 →CVE-2024-26735 →CVE-2024-26801 →CVE-2023-52781 →CVE-2024-26859 →CVE-2024-35845 →CVE-2024-26585 →CVE-2024-26804 →CVE-2024-35852 →CVE-2024-36004 →CVE-2024-26826 →CVE-2021-47456 →CVE-2023-52878 →CVE-2021-46972 →CVE-2021-47069 →CVE-2021-47356 →CVE-2023-5090 →CVE-2023-52703 →CVE-2024-26675 →CVE-2024-35789 →CVE-2024-35853 →CVE-2020-26555 →

📋 Description

CVE-2020-26555 — kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack CVE-2021-46909 — kernel: PCI interrupt mapping cause oops CVE-2021-46972 — kernel: ovl: fix leaked dentry CVE-2021-47069 — kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry CVE-2021-47073 — kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios CVE-2021-47236 — kernel: net: cdc_eem: fix tx fixup skb leak CVE-2021-47310 — kernel: net: ti: fix UAF in tlan_remove_one CVE-2021-47311 — kernel: net: qcom/emac: fix UAF in emac_remove CVE-2021-47353 — kernel: udf: Fix NULL pointer dereference in udf_symlink function CVE-2021-47356 — kernel: mISDN: fix possible use-after-free in HFC_cleanup() CVE-2021-47456 — kernel: can: peak_pci: peak_pci_remove(): fix UAF CVE-2021-47495 — kernel: usbnet: sanity check for maxpacket CVE-2023-5090 — kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs CVE-2023-52464 — kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c CVE-2023-52560 — kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() CVE-2023-52615 — kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng CVE-2023-52626 — kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context CVE-2023-52667 — kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups CVE-2023-52700 — kernel: tipc: fix kernel warning when sending SYN message CVE-2023-52703 — kernel: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path CVE-2023-52781 — kernel: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' CVE-2023-52813 — kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET CVE-2023-52835 — kernel: perf/core: Bail out early if the request AUX area is out of bound CVE-2023-52877 — kernel: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() CVE-2023-52878 — kernel: can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds CVE-2023-52881 — kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number CVE-2024-26583 — kernel: tls: race between async notify and socket close CVE-2024-26584 — kernel: tls: handle backlogging of crypto requests CVE-2024-26585 — kernel: tls: race between tx work scheduling and socket close CVE-2024-26656 — kernel: drm/amdgpu: use-after-free vulnerability CVE-2024-26675 — kernel: ppp_async: limit MRU to 64K CVE-2024-26735 — kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref CVE-2024-26759 — kernel: mm/swap: fix race when skipping swapcache CVE-2024-26801 — kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26804 — kernel: net: ip_tunnel: prevent perpetual headroom growth CVE-2024-26826 — kernel: mptcp: fix data re-injection from stale subflow CVE-2024-26859 — kernel: net/bnx2x: Prevent access to a freed page in page_pool CVE-2024-26906 — kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() CVE-2024-26907 — kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment CVE-2024-26974 — kernel: crypto: qat - resolve race condition during AER recovery CVE-2024-26982 — kernel: Squashfs: check the inode number is not the invalid value of zero CVE-2024-27397 — kernel: netfilter: nf_tables: use timestamp to check for set element timeout CVE-2024-27410 — kernel: wifi: nl80211: reject iftype change with mesh ID change CVE-2024-35789 — kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes CVE-2024-35835 — kernel: net/mlx5e: fix a double-free in arfs_create_groups CVE-2024-35838 — kernel: wifi: mac80211: fix potential sta-link leak CVE-2024-35845 — kernel: wifi: iwlwifi: dbg-tlv: ensure NUL termination CVE-2024-35852 — kernel: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work CVE-2024-35853 — kernel: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash CVE-2024-35854 — kernel: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash CVE-2024-35855 — kernel: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update CVE-2024-35888 — kernel: erspan: make sure erspan_base_hdr is present in skb->head CVE-2024-35890 — kernel: gro: fix ownership transfer CVE-2024-35958 — kernel: net: ena: Fix incorrect descriptor free behavior CVE-2024-35959 — kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow CVE-2024-35960 — kernel: net/mlx5: Properly link new fs rules into the tree CVE-2024-36004 — kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue CVE-2024-36007 — kernel: mlxsw: spectrum_acl_tcam: Fix warning during rehash

🎯 Affected products32

  • Red Hat Enterprise Linux NFV (v. 8)
  • Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10.src as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10.src as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-core-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-core-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-kvm-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-devel-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-devel-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-kvm-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.8.1.rt7.349.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: It is recommended that devices not accept connections from or initiate connections to remote devices claiming the same Bluetooth device address as their own, also a controller computing a null (zero-valued) combination not accept this key as a valid and fail any pairing attempt that produced a null key. It is also recommends that BR/EDR implementations enable Secure Simple Pairing, and where possible, implementations enable and enforce Secure Connections Only Mode, ensuring that pin-code pairing cannot be used. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available. Workaround: To mitigate this issue, prevent module mlx5_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: No current mitigation is available for this vulnerability. Please make sure to have kernel up-to-date as soon as the patches are available to make sure the flaw mitigated. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent module iwlwifi from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (61)