CVE-2024-50253

In the Linux kernel, the following vulnerability has been resolved: bpf: Check the validity of nrwords in bpfiterbitsnew Check the validity of nrwords in bpfiterbitsnew. Without this check, when multiplication overflow occurs for nrbits e.g., when nrwords = 0x0400-0001, nrbits becomes 64, stack...

CVE-2024-53091

In the Linux kernel, the following vulnerability has been resolved: bpf: Add skisinet and ISICSK check in tlsswhasctxtx/rx As the introduction of the support for vsock and unix sockets in sockmap, tlsswhasctxtx/rx cannot presume the socket passed in must be ISICSK. vsock and afunix sockets have...

CVE-2024-53091 bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx

In the Linux kernel, the following vulnerability has been resolved: bpf: Add skisinet and ISICSK check in tlsswhasctxtx/rx As the introduction of the support for vsock and unix sockets in sockmap, tlsswhasctxtx/rx cannot presume the socket passed in must be ISICSK. vsock and afunix sockets have...

CVE-2024-53091

The connected Astra Linux bulletin and CVE record confirm a Linux kernel TLS offload flaw (CVE-2024-53091) addressed by a patch that adds sk_is_inet and IS_ICSK checks in tls_sw_has_ctx_tx/rx. The change is motivated by support for vsock and af_unix sockets in sockmap, where sockets can be vsock_...

CVE-2024-50254

In the Linux kernel, the following vulnerability has been resolved: bpf: Free dynamically allocated bits in bpfiterbitsdestroy bpfiterbitsdestroy uses "kit-nrbits kmemleakalloc+0x4b/0x80 kmallocnodenoprof+0x480/0x5c0 alloc.isra.0+0x89/0xb0 allocbulk+0x2af/0x720 prefillmemcache+0x7f/0xb0...

CVE-2024-53054

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-53054

In the Linux kernel, the following vulnerability has been resolved: cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction A hungtask problem shown below was found: INFO: task kworker/0:0:8 blocked for more than 327 seconds. "echo 0 /proc/sys/kernel/hungtasktimeoutsecs" disables this...

CVE-2024-53054

CVE-2024-53054 is documented in connected sources as a Linux kernel issue affecting the cgroup/bpf destruction path. The root cause described is a contention/deadlock risk from cgroup_bpf_release workers, due to mutexes and locks acquired across tasks, which could lead to a hung task scenario. Af...

Oracle Linux 9 : oci-seccomp-bpf-hook (ELSA-2024-9277)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-9277 advisory. 1.2.10-2 - rebuild - Resolves: RHEL-35939 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Ness...

USN-7089-6 linux-gke vulnerabilities

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. CVE-2024-25741 Several security issues were discovered in the Linux kernel. An...

oci-seccomp-bpf-hook security update

1.2.10-2 - rebuild - Resolves: RHEL-35939...

bcc security update

0.30.0-6 - Rebuild with LLVM 18 RHEL-28684 0.30.0-5 - Drop python3-pyelftools dependency on s390x until it is available 0.30.0-4 - Exclude btrfs and f2fs libbpf tools RHEL-36579 0.30.0-3 - Really prevent the loading of compromised headers RHEL-28769, CVE-2024-2314 - Add python3-pyelftools...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHSA-2024:9277 Red Hat Security Advisory: oci-seccomp-bpf-hook security update

Bulletin has no description...

The vulnerability of the libbpf component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the libbpf component in the Linux operating system’s kernel is related to errors in reading beyond the boundary in the bpfxdpquery function. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: xsk: fix usage of multi-buffer BPF helpers for ZC XDP

In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF helpers for ZC XDP Currently when packet is shrunk via bpfxdpadjusttail and memory type is set to MEMTYPEXSKBUFFPOOL, null ptr dereference happens: 1136314.192256 BUG: kernel NULL pointer...

kernel: bpf: Fix re-attachment branch in bpf_tracing_prog_attach

bpf: Fix re-attachment branch in bpftracingprogattach The following case can cause a crash due to missing attachbtf: 1 load rawtp program 2 load fentry program with rawtp as targetfd 3 create tracing link for fentry program with targetfd = 0 4 repeat 3 In the end we have: - prog-aux-dsttrampoline...

kernel: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld before calling bpf map helpers These three bpfmaplookup,update,deleteelem helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program,...

Low: Red Hat Security Advisory: bcc security update

An update for bcc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

RHEL 9 : oci-seccomp-bpf-hook (RHSA-2024:9277)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9277 advisory. OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to u...