Security Bulletin: IBM MQ Appliance is affected by a Linux Kernel vulnerability (CVE-2023-28466)

Summary

IBM MQ Appliance has addressed a Linux Kernel denial of service vulnerability.

Vulnerability Details

CVEID:CVE-2023-28466
**DESCRIPTION:**Linux Kernel is vulnerable to a denial of service, caused by the lack of a lock_sock call in do_tls_getsockopt in net/tls/tls_main.c. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a race condition, and result in a denial of service condition.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/250343 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under APAR IT45642

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance 9.3.0.17 cumulative security update, or later firmware.

IBM MQ Appliance version 9.3 CD

Apply IBM MQ Appliance 9.3.5.1 cumulative security update, or later firmware.

Workarounds and Mitigations

None