ALSA-2023:2458

Source
https://errata.almalinux.org/9/ALSA-2023-2458.html
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2023:2458.json
JSON Data
https://api.osv.dev/v1/vulns/ALSA-2023:2458
Related
Published
2023-05-09T00:00:00Z
Modified
2023-05-12T03:34:53Z
Summary
Important: kernel security, bug fix, and enhancement update
Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

  • use-after-free in l2capconnect and l2capleconnectreq in net/bluetooth/l2cap_core.c (CVE-2022-42896)
  • net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
  • cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
  • malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
  • possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
  • KVM: NULL pointer dereference in kvmmmuinvpcid_gva (CVE-2022-1789)
  • use-after-free in freepipeinfo() could lead to privilege escalation (CVE-2022-1882)
  • KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
  • netfilter: nfconntrackirc message handling issue (CVE-2022-2663)
  • race condition in xfrmprobealgs can lead to OOB read/write (CVE-2022-3028)
  • out-of-bounds read in fibnhmatch of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
  • race condition in hugetlbnopage() in mm/hugetlb.c (CVE-2022-3522)
  • memory leak in ipv6renewoptions() (CVE-2022-3524)
  • data races around icsk->icskafops in doipv6setsockopt (CVE-2022-3566)
  • data races around sk->sk_prot (CVE-2022-3567)
  • memory leak in l2caprecvacldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
  • denial of service in followpagepte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
  • use-after-free after failed devlink reload in devlinkparamget (CVE-2022-3625)
  • USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
  • use after free flaw in l2capconndel in net/bluetooth/l2cap_core.c (CVE-2022-3640)
  • Double-free in split2MBgttentry when function intelgvtdmamapguestpage failed (CVE-2022-3707)
  • mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
  • l2tp: missing lock when clearing skuserdata can lead to NULL pointer dereference (CVE-2022-4129)
  • igmp: use-after-free in ipcheckmc_rcu when opening and closing inet sockets (CVE-2022-20141)
  • lockdown bypass using IMA (CVE-2022-21505)
  • double free in usb8devstartxmit in drivers/net/can/usb/usb8dev.c (CVE-2022-28388)
  • network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
  • unmapmappingrange() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
  • TLB flush operations are mishandled in certain KVMVCPUPREEMPTED leading to guest malfunctioning (CVE-2022-39189)
  • u8 overflow problem in cfg80211updatenotlisted_nontrans() (CVE-2022-41674)
  • use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
  • use-after-free in bssrefget in net/wireless/scan.c (CVE-2022-42720)
  • BSS list corruption in cfg80211addnontrans_list in net/wireless/scan.c (CVE-2022-42721)
  • Denial of service in beacon protection for P2P-device (CVE-2022-42722)
  • memory corruption in usbmon driver (CVE-2022-43750)
  • NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
  • NULL pointer dereference in rawv6pushpending_frames (CVE-2023-0394)
  • use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
  • use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
  • denial of service in tipcconnclose (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

Affected packages

AlmaLinux:9 / bpftool

Package

Name
bpftool

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.0-284.11.1.el9_2

AlmaLinux:9 / kernel

Package

Name
kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k

Package

Name
kernel-64k

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-core

Package

Name
kernel-64k-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug

Package

Name
kernel-64k-debug

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug-core

Package

Name
kernel-64k-debug-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug-devel

Package

Name
kernel-64k-debug-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug-devel-matched

Package

Name
kernel-64k-debug-devel-matched

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug-modules

Package

Name
kernel-64k-debug-modules

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug-modules-core

Package

Name
kernel-64k-debug-modules-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-debug-modules-extra

Package

Name
kernel-64k-debug-modules-extra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-devel

Package

Name
kernel-64k-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-devel-matched

Package

Name
kernel-64k-devel-matched

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-modules

Package

Name
kernel-64k-modules

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-modules-core

Package

Name
kernel-64k-modules-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-64k-modules-extra

Package

Name
kernel-64k-modules-extra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-abi-stablelists

Package

Name
kernel-abi-stablelists

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-core

Package

Name
kernel-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-cross-headers

Package

Name
kernel-cross-headers

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug

Package

Name
kernel-debug

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-core

Package

Name
kernel-debug-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-devel

Package

Name
kernel-debug-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-devel-matched

Package

Name
kernel-debug-devel-matched

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-modules

Package

Name
kernel-debug-modules

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-modules-core

Package

Name
kernel-debug-modules-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-modules-extra

Package

Name
kernel-debug-modules-extra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-debug-uki-virt

Package

Name
kernel-debug-uki-virt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-devel

Package

Name
kernel-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-devel-matched

Package

Name
kernel-devel-matched

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-doc

Package

Name
kernel-doc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-modules

Package

Name
kernel-modules

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-modules-core

Package

Name
kernel-modules-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-modules-extra

Package

Name
kernel-modules-extra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-tools

Package

Name
kernel-tools

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-tools-libs

Package

Name
kernel-tools-libs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-tools-libs-devel

Package

Name
kernel-tools-libs-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-uki-virt

Package

Name
kernel-uki-virt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump

Package

Name
kernel-zfcpdump

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump-core

Package

Name
kernel-zfcpdump-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump-devel

Package

Name
kernel-zfcpdump-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump-devel-matched

Package

Name
kernel-zfcpdump-devel-matched

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump-modules

Package

Name
kernel-zfcpdump-modules

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump-modules-core

Package

Name
kernel-zfcpdump-modules-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / kernel-zfcpdump-modules-extra

Package

Name
kernel-zfcpdump-modules-extra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / perf

Package

Name
perf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / python3-perf

Package

Name
python3-perf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2

AlmaLinux:9 / rtla

Package

Name
rtla

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.14.0-284.11.1.el9_2