Important: kernel-livepatch-4.14.344-262.563

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftexprtypeget CVE-2024-27020 Affected Packages: kernel-livepatch-4.14.344-262.563 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Important: kernel-livepatch-4.14.345-262.561

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftexprtypeget CVE-2024-27020 Affected Packages: kernel-livepatch-4.14.345-262.561 Issue Correction: Please ensure you have live patching enabled. Run yum update...

kernel: netfilter: nf_tables: do not compare internal table flags on updates

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags...

kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion

This CVE involves a flaw in the Linux kernel's nftables component, part of the Netfilter framework used for packet filtering and firewall functionalities. The vulnerability arises when a table's dormant flag is updated while there's a pending deletion of a base chain. In such cases, the...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix potential data-race in nftflowtabletypeget The Linux kernel CVE team has assigned CVE-2024-35898 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: use timestamp to check for set element timeout

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic when DSA master device unbinds on shutdown CVE-2022-48808 In the Linux kernel, the following vulnerability has been resolved: nfsd: call oprelease, even when opfunc returns an error...

kernel: netfilter: nf_tables: reject new basechain after table flag update

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update The Linux kernel CVE team has assigned CVE-2024-35900 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: fix memleak in map from abort path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix memleak in map from abort path The Linux kernel CVE team has assigned CVE-2024-27011 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050148-CVE-2024-27011-2c70@gregkh/T...

kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

A flaw was found in the Linux kernel’s Netfilter nftables module. The issue arises from improper mutex handling during the garbage collection GC process. The problem occurs between the critical functions nftgcseqbegin and nftgcseqend, where a mutex lock is incorrectly released too early, leading ...

kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory:...

kernel: netfilter: nf_tables: flush pending destroy work before exit_net release

A vulnerability was found in the Linux kernel's Netfilter framework, specifically within the nftables component. The issue arises from a race condition between the exitnet function and the destroy work queue, which can lead to use-after-free errors and potential system instability. This...

kernel: netfilter: nf_tables: reject new basechain after table flag update

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update The Linux kernel CVE team has assigned CVE-2024-35900 to this issue. Upstream advisory:...

kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()

A flaw was found in the Linux kernel's netfilter component, specifically within the nfnetlinkqueue module. A local attacker with low privileges could trigger a race condition by calling nfreinject without the required rcureadlock in the instancedestroyrcu function. This could lead to suspicious R...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

A flaw was found in the Linux kernel. A potential data-race in the nftexprtypeget function exists...

kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion

This CVE involves a flaw in the Linux kernel's nftables component, part of the Netfilter framework used for packet filtering and firewall functionalities. The vulnerability arises when a table's dormant flag is updated while there's a pending deletion of a base chain. In such cases, the...

kernel: netfilter: nf_tables: do not compare internal table flags on updates

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags...