RHSA-2024:4928MediumCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
July 31, 2024
Last Modified
August 19, 2026

🔗 CVE IDs covered (18)

CVE-2024-35907 →CVE-2023-52809 →CVE-2024-35857 →CVE-2024-35952 →CVE-2024-36924 →CVE-2022-48743 →CVE-2024-26852 →CVE-2024-26880 →CVE-2024-36952 →CVE-2021-47459 →CVE-2024-26737 →CVE-2024-26773 →CVE-2024-27030 →CVE-2024-27046 →CVE-2024-35885 →CVE-2024-38580 →CVE-2023-52458 →CVE-2024-26982 →

📋 Description

CVE-2021-47459 — kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv CVE-2022-48743 — kernel: net: amd-xgbe: Fix skb data length underflow CVE-2023-52458 — kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned CVE-2023-52809 — kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() CVE-2024-26737 — kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel CVE-2024-26773 — kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() CVE-2024-26852 — kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() CVE-2024-26880 — kernel: dm: call the resume method on internal suspend CVE-2024-26982 — kernel: Squashfs: check the inode number is not the invalid value of zero CVE-2024-27030 — kernel: octeontx2-af: race condition on interupts CVE-2024-27046 — kernel: nfp: flower: handle acti_netdevs allocation failure CVE-2024-35857 — kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() CVE-2024-35885 — kernel: mlxbf_gige: stop interface during shutdown CVE-2024-35907 — kernel: mlxbf_gige: call request_irq() after NAPI initialized CVE-2024-35952 — kernel: drm/ast: Fix soft lockup CVE-2024-36924 — kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() CVE-2024-36952 — kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up CVE-2024-38580 — kernel: epoll: be better about file lifetimes

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CRB (v. 9)
  • Red Hat Enterprise Linux NFV (v. 9)
  • Red Hat Enterprise Linux RT (v. 9)
  • bpftool-0:7.3.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.3.0-427.28.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.3.0-427.28.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.3.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.s390x as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux RT (v. 9)
  • kernel-0:5.14.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.28.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.28.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.28.1.el9_4.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.28.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-427.28.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available. Workaround: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (20)