(RHSA-2023:5627) Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

• kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route (CVE-2023-4128)

• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

• kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• kernel: LoadPin bypass via dm-verity table reload (CVE-2022-2503)

• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

• kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice (CVE-2022-36879)

• kernel: use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

• kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head (CVE-2023-1095)

• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [HPEMC RHEL 8 REGRESSION] acpi-cpufreq: Skip initialization if a cpufreq driver exists (BZ#2186307)

• [max] RHEL8.4 Pre-Alpha - [ 4.18.0-240.4.el8.dt2.ppc64le ][ fleetwood / P9 64TB/192c ] While performing DLPAR CPU operations “BUG: arch topology borken” messages are observed and CPU remove operation fails for removal of 140 with 255 return (BZ#2210295)

• [Intel 8.8 BUG] [SPR] IOMMU: QAT Device Address Translation Issue with Invalidation Completion Ordering (BZ#2221098)

• avoid unnecessary page fault retires on shared memory types (BZ#2221101)

• [i40e] error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228164)

• oops on cifs_mount due to null tcon (BZ#2229129)

• kernel panic due to stack overflow on ppc64le due to deep call chain. (BZ#2230268)

• [Hyper-V][RHEL 8]incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230744)

• Withdrawal: GFS2: couldn’t freeze filesystem: -16 (BZ#2231826)

• [RHEL 8][Hyper-V]Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231989)

• kernel-devel RPM cross-compiled by CKI contains host-arch scripts (BZ#2232138)

• RHEL-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232216)

• [Intel 8.9] iavf: Driver Update (BZ#2232400)

• Important iavf bug fixes July 2023 (BZ#2232401)

• iavf: hang in iavf_remove() - SNO node hangs after running systemctl reboot (BZ#2232404)

• [RHEL 8.9] Proactively backport locking fixes from upstream (BZ#2235394)

• NAT sport clash in OCP causing 1 second TCP connection establishment delay. (BZ#2236515)

• xfs: mount fails when device file name is long (BZ#2236814)

• netfilter: RHEL 8.8 phase 2 backports from upstream (BZ#2236817)

• swap deadlock when attempt to charge a page to a cgroup stalls waiting on I/O plugged on another task in swap code (BZ#2237686)

Enhancement(s):

• [Intel 8.7 FEAT] TSC: Avoid clock watchdog when not needed (BZ#2216051)