(RHSA-2024:4415) Important: kernel security and bug fix update

2024-07-0908:53:07

access.redhat.com

kernel packages

linux kernel

netfilter

privilege escalation

smb client

oobs

kvm

uaf

lpi translation cache

nft_ct

jira

rhel-15150

rhel-30259

rhel-30560

cve-2024-0193

cve-2023-52434

cve-2024-26598

cve-2024-26673

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

JSON

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation (CVE-2024-0193)
kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
kernel: kvm: Avoid potential UAF in LPI translation cache (CVE-2024-26598)
kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (CVE-2024-26673)

Bug Fix(es):

multi-page bvec configuration for integrity payload (JIRA:RHEL-15150)
ipoib mcast lockup fix (JIRA:RHEL-30259)
Kernel panic in skb_segment (JIRA:RHEL-30560)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat9ppc64lekernel-core< 5.14.0-70.105.1.el9_0kernel-core-5.14.0-70.105.1.el9_0.ppc64le.rpm
RedHat9x86_64kernel-debug-devel< 5.14.0-70.105.1.el9_0kernel-debug-devel-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat9x86_64kernel-debuginfo-common-x86_64< 5.14.0-70.105.1.el9_0kernel-debuginfo-common-x86_64-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat9s390xkernel-zfcpdump-modules-extra< 5.14.0-70.105.1.el9_0kernel-zfcpdump-modules-extra-5.14.0-70.105.1.el9_0.s390x.rpm
RedHat9x86_64kernel-debuginfo< 5.14.0-70.105.1.el9_0kernel-debuginfo-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat9x86_64kernel-debug-core< 5.14.0-70.105.1.el9_0kernel-debug-core-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat9ppc64lekernel-devel-matched< 5.14.0-70.105.1.el9_0kernel-devel-matched-5.14.0-70.105.1.el9_0.ppc64le.rpm
RedHat9x86_64kernel-debug-devel-matched< 5.14.0-70.105.1.el9_0kernel-debug-devel-matched-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat9x86_64kernel-debug< 5.14.0-70.105.1.el9_0kernel-debug-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat9aarch64kernel-tools< 5.14.0-70.105.1.el9_0kernel-tools-5.14.0-70.105.1.el9_0.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	9	ppc64le	kernel-core	< 5.14.0-70.105.1.el9_0	kernel-core-5.14.0-70.105.1.el9_0.ppc64le.rpm
RedHat	9	x86_64	kernel-debug-devel	< 5.14.0-70.105.1.el9_0	kernel-debug-devel-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat	9	x86_64	kernel-debuginfo-common-x86_64	< 5.14.0-70.105.1.el9_0	kernel-debuginfo-common-x86_64-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat	9	s390x	kernel-zfcpdump-modules-extra	< 5.14.0-70.105.1.el9_0	kernel-zfcpdump-modules-extra-5.14.0-70.105.1.el9_0.s390x.rpm
RedHat	9	x86_64	kernel-debuginfo	< 5.14.0-70.105.1.el9_0	kernel-debuginfo-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat	9	x86_64	kernel-debug-core	< 5.14.0-70.105.1.el9_0	kernel-debug-core-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat	9	ppc64le	kernel-devel-matched	< 5.14.0-70.105.1.el9_0	kernel-devel-matched-5.14.0-70.105.1.el9_0.ppc64le.rpm
RedHat	9	x86_64	kernel-debug-devel-matched	< 5.14.0-70.105.1.el9_0	kernel-debug-devel-matched-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat	9	x86_64	kernel-debug	< 5.14.0-70.105.1.el9_0	kernel-debug-5.14.0-70.105.1.el9_0.x86_64.rpm
RedHat	9	aarch64	kernel-tools	< 5.14.0-70.105.1.el9_0	kernel-tools-5.14.0-70.105.1.el9_0.aarch64.rpm