RHSA-2024:5257HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
August 13, 2024
Last Modified
October 20, 2026

🔗 CVE IDs covered (17)

CVE-2024-35898 →CVE-2021-47624 →CVE-2024-26642 →CVE-2024-27403 →CVE-2024-35897 →CVE-2024-40978 →CVE-2024-26808 →CVE-2024-27393 →CVE-2024-36886 →CVE-2024-36971 →CVE-2024-41091 →CVE-2024-26993 →CVE-2024-41090 →CVE-2024-39502 →CVE-2023-52639 →CVE-2024-21823 →CVE-2024-27397 →

📋 Description

CVE-2021-47624 — kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change CVE-2023-52639 — kernel: KVM: s390: vsie: fix race during shadow creation CVE-2024-21823 — kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application CVE-2024-26642 — kernel: netfilter: nf_tables: disallow anonymous set with timeout flag CVE-2024-26808 — kernel: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain CVE-2024-26993 — kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() CVE-2024-27393 — kernel: xen-netfront: Add missing skb_mark_for_recycle CVE-2024-27397 — kernel: netfilter: nf_tables: use timestamp to check for set element timeout CVE-2024-27403 — kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow CVE-2024-35897 — kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion CVE-2024-35898 — kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() CVE-2024-36886 — kernel: TIPC message reassembly use-after-free remote code execution vulnerability CVE-2024-36971 — kernel: net: kernel: UAF in network route management CVE-2024-39502 — kernel: ionic: fix use after netif_napi_del() CVE-2024-40978 — kernel: scsi: qedi: Fix crash while reading debugfs attribute CVE-2024-41090 — kernel: virtio-net: tap: mlx5_core short frame denial of service CVE-2024-41091 — kernel: virtio-net: tun: mlx5_core short frame denial of service

🎯 Affected products136

  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-0:5.14.0-70.112.1.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-0:5.14.0-70.112.1.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • bpftool-debuginfo-0:5.14.0-70.112.1.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-0:5.14.0-70.112.1.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-0:5.14.0-70.112.1.el9_0.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-0:5.14.0-70.112.1.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-abi-stablelists-0:5.14.0-70.112.1.el9_0.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-core-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-core-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-core-0:5.14.0-70.112.1.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-core-0:5.14.0-70.112.1.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-debug-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-debug-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-debug-0:5.14.0-70.112.1.el9_0.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-debug-0:5.14.0-70.112.1.el9_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-debug-core-0:5.14.0-70.112.1.el9_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • kernel-debug-core-0:5.14.0-70.112.1.el9_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • +106 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue, prevent module sunrpc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: The TIPC module is not automatically loaded in default configurations. When required, administrative privileges are required to explicitly load this module. To determine if the TIPC module is loaded, use the following command: # grep tipc /proc/modules Look for output similar to the following: tipc 479232 0 - Live 0xffffffffc1ba5000 ip6_udp_tunnel 16384 1 tipc, Live 0xffffffffc1b9b000 udp_tunnel 32768 1 tipc, Live 0xffffffffc1b8b000 Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (20)