(RHSA-2023:4789) Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

• kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter (CVE-2023-1829)

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)

• kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

• Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

• kernel: OOB access in the Linux kernel’s XFS subsystem (CVE-2023-2124)

• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

• kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Simultaneous writes to a page on xfs can result in zero-byte data (BZ#2184103)

• Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst (BZ#2208286)

• Low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208542)

• Windows Server 2019 guest randomly pauses with “KVM: entry failed, hardware error 0x80000021” (BZ#2211663)

• Marvell 8.7 Bug qedi shutdown handler hangs upon reboot (BZ#2215334)

• aacraid misses interrupts when a CPU is disabled resulting in scsi timeouts and the adapter being unusable until reboot. (BZ#2216499)

• rbd: avoid fast-diff corruption in snapshot-based mirroring [8.9] (BZ#2216770)

• OCS 4.8 cephfs kernel crash : mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218273)

• FJ8.6 Bug: System panic occurs because the list used by i40e driver is corrupted (BZ#2219262)

• st_gmac tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219908)

• Regression of 3b8cc6298724 (“blk-cgroup: Optimize blkcg_rstat_flush()”) (BZ#2220811)

• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221011)

• Scheduler update (rhel8.8) (BZ#2221304)

• RHEL8.6 boot panic with message “kernel BUG at lib/list_debug.c:28!” (BZ#2222247)

• Enable conntrack clash resolution for GRE (BZ#2223543)

• Intel 8.8 BUG SPR perf: Workaround the UPI intel_uncore_has_discovery_tables issue on SPR MCC and LCC (BZ#2225514)

• KVM: x86: fix sending PV IPI (BZ#2226580)

• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227074)

Enhancement(s):

• Mellanox 8.7 FEAT mlx5: It’s possible to enable LRO when XDP is active (BZ#2165585)

• Export symbol pci_find_host_bridge (BZ#2225335)