RHEL 8 : kernel (RHSA-2022:7110)

high Nessus Plugin ID 166478

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7110 advisory.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

* Information leak in scsi_ioctl() (CVE-2022-0494)

* A kernel-info-leak issue in pfkey_register (CVE-2022-1353)

* RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

* Branch Type Confusion (non-retbleed) (CVE-2022-23825)

* RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Add s390_iommu_aperture kernel parameter (BZ#2081324)

* Blackscreen and hangup after resume from hibernate or S3 with DFGX WX3200 (BZ#2091065)

* Update NVME subsystem with bug fixes and minor changes (BZ#2106017)

* Fix parsing of nw_proto for IPv6 fragments (BZ#2106703)

* vmcore failed, _exitcode:139 error observed while capturing vmcore during fadump after memory remove.
incomplete vmcore is captured. (BZ#2107488)

* 'disable_policy' is ignored for addresses configured on a down interface (BZ#2109971)

* Backport request for new cpufreq.default_governor kernel command line parameter (BZ#2109996)

* Panics in mpt3sas mpt3sas_halt_firmware() if mpt3sas_fwfault_debug=1 enabled when poweroff issued to server (BZ#2111140)

* IOMMU/DMA update for 8.7 (BZ#2111692)

* Update Broadcom Emulex lpfc driver for RHEL8.7 with bug fixes (14.0.0.13) (BZ#2112103)

* Incorrect Socket(s) & Core(s) per socket reported by lscpu command. (BZ#2112820)

* Panic in ch_release() due to NULL ch->device pointer, backport upstream fix (BZ#2115965)

* pyverbs-tests fail over qede IW HCAs on test_query_rc_qp (tests.test_qp.QPTest) (BZ#2119122)

* qedi shutdown handler hangs upon reboot (BZ#2119847)

* cache link_info for ethtool (BZ#2120197)

* Important iavf bug fixes (BZ#2120225)

* Hibernate crash with Aquantia 2.5/5 Gb LAN card (BZ#2124966)

* While using PTimekeeper the qede driver produces excessive log messages (BZ#2125477)

* general protection fault handling rpc_xprt.timer (BZ#2126184)

* Not enough device MSI-X vectors (BZ#2126482)

* Atlantic driver panic on wakeup after hybernate (BZ#2127845)

* Memory leak in vxlan_xmit_one (BZ#2131255)

* Missing hybernate/resume fixes (BZ#2131936)

Enhancement(s):

* Update smartpqi driver to latest upstream Second Set of Patches (BZ#2112354)

* qed/qede/qedr - driver updates to latest upstream (BZ#2120611)

* Update qedi driver to latest upstream (BZ#2120612)

* Update qedf driver to latest upstream (BZ#2120613)

* Include the support for new NVIDIA Mobile GFX GA103 on ADL Gen Laptops (BZ#2127122)

* Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129923)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 166478

File Name: redhat-RHSA-2022-7110.nasl

Version: 1.12

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 10/25/2022

Updated: 9/12/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2022-0494

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2022-2588

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules, p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:bpftool, p-cpe:/a:redhat:enterprise_linux:kernel-tools, p-cpe:/a:redhat:enterprise_linux:kernel-modules, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules, p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump, p-cpe:/a:redhat:enterprise_linux:kernel-devel, cpe:/o:redhat:rhel_eus:8.6, p-cpe:/a:redhat:enterprise_linux:python3-perf, p-cpe:/a:redhat:enterprise_linux:kernel-debug-core, p-cpe:/a:redhat:enterprise_linux:perf, cpe:/o:redhat:enterprise_linux:8, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel, p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers, p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-core, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/25/2022

Vulnerability Publication Date: 3/25/2022

Exploitable With

Core Impact

Reference Information

CVE: CVE-2022-0494, CVE-2022-1353, CVE-2022-23825, CVE-2022-2588, CVE-2022-28693, CVE-2022-29900, CVE-2022-29901, CVE-2022-49611, CVE-2022-50053, CVE-2022-50054

CWE: 1037, 200, 212, 416, 476, 833, 908

RHSA: 2022:7110

Detections

Analytics