RHEL 9 : kernel (RHSA-2024:2394)

critical Nessus Plugin ID 194794

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2394 advisory.

- kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

- kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

- kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

- kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)

- kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

- kernel: cxgb4: use-after-free in ch_flower_stats_cb() (CVE-2023-4133)

- kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)

- kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get (CVE-2023-6121)

- kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)

- kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)

- kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

- kernel: null pointer dereference vulnerability in nft_dynset_init() (CVE-2023-6622)

- kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c (CVE-2023-6915)

- kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)

- kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

- kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)

- kernel: irdma: Improper access control (CVE-2023-25775)

- Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)

- kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)

- kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)

- kernel: usb: out-of-bounds read in read_descriptors (CVE-2023-37453)

- kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

- kernel: netfilter: xtables sctp out-of-bounds read in match_flags() (CVE-2023-39193)

- kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match() (CVE-2023-39194)

- kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create() (CVE-2023-39198)

- kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach() (CVE-2023-42754)

- kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)

- kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)

- kernel: NULL pointer dereference vulnerability in io_uring_show_fdinfo (CVE-2023-46862)

- kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c (CVE-2023-51043)

- kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg (CVE-2023-51779)

- kernel: use-after-free in net/atm/ioctl.c (CVE-2023-51780)

- kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

- kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (CVE-2023-52448)

- kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)

- kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

- kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)

- kernel: HID: sony: Fix a potential memory leak in sony_probe() (CVE-2023-52529)

- kernel: team: NULL pointer dereference when team device type is changed (CVE-2023-52574)

- kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

- kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)

- kernel: netfilter: nf_tables: memory leak when more than 255 elements expired (CVE-2023-52581)

- kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

- kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)

- kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)

- kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function (CVE-2024-0841)

- kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function (CVE-2024-1085)

- kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

- kernel: tls: use-after-free with partial reads and async decrypt (CVE-2024-26582)

- kernel: tls: race between async notify and socket close (CVE-2024-26583)

- kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)

- kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)

- kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

- kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

- kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

- kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)

- kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 194794

File Name: redhat-RHSA-2024-2394.nasl

Version: 1.1

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 4/30/2024

Updated: 5/1/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.6

CVSS v2

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.2

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2020-26555

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2023-25775

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules, p-cpe:/a:redhat:enterprise_linux:bpftool, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-core, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug, p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules-core, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules, p-cpe:/a:redhat:enterprise_linux:kernel-modules, p-cpe:/a:redhat:enterprise_linux:kernel-tools, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug-modules-core, p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules, p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-64k, p-cpe:/a:redhat:enterprise_linux:kernel-rt-core, p-cpe:/a:redhat:enterprise_linux:rtla, p-cpe:/a:redhat:enterprise_linux:kernel-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump, p-cpe:/a:redhat:enterprise_linux:python3-perf, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-64k-modules-core, p-cpe:/a:redhat:enterprise_linux:kernel-debug-core, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules-extra, p-cpe:/a:redhat:enterprise_linux:perf, p-cpe:/a:redhat:enterprise_linux:kernel-devel-matched, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs, p-cpe:/a:redhat:enterprise_linux:kernel-uki-virt, p-cpe:/a:redhat:enterprise_linux:libperf, p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers, p-cpe:/a:redhat:enterprise_linux:kernel-modules-core, p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel-matched, p-cpe:/a:redhat:enterprise_linux:rv, cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug-core, p-cpe:/a:redhat:enterprise_linux:kernel-core, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-core, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug-devel-matched, p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel-matched, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug-modules, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-modules-core, p-cpe:/a:redhat:enterprise_linux:kernel-64k-modules, p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core, p-cpe:/a:redhat:enterprise_linux:kernel-64k-core, p-cpe:/a:redhat:enterprise_linux:kernel-64k-devel, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-debug-uki-virt, p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug, p-cpe:/a:redhat:enterprise_linux:kernel-64k-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-64k-devel-matched, p-cpe:/a:redhat:enterprise_linux:kernel-64k-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-core

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/30/2024

Vulnerability Publication Date: 5/24/2021

Exploitable With

Core Impact

Reference Information

CVE: CVE-2020-26555, CVE-2022-0480, CVE-2022-38096, CVE-2022-45934, CVE-2023-24023, CVE-2023-25775, CVE-2023-28464, CVE-2023-28866, CVE-2023-31083, CVE-2023-3567, CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-39194, CVE-2023-39198, CVE-2023-4133, CVE-2023-42754, CVE-2023-42756, CVE-2023-45863, CVE-2023-46862, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2023-52434, CVE-2023-52448, CVE-2023-52476, CVE-2023-52489, CVE-2023-52522, CVE-2023-52529, CVE-2023-52574, CVE-2023-52578, CVE-2023-52580, CVE-2023-52581, CVE-2023-52610, CVE-2023-52620, CVE-2023-6040, CVE-2023-6121, CVE-2023-6176, CVE-2023-6531, CVE-2023-6546, CVE-2023-6622, CVE-2023-6915, CVE-2023-6931, CVE-2023-6932, CVE-2024-0565, CVE-2024-0841, CVE-2024-1085, CVE-2024-1086, CVE-2024-26582, CVE-2024-26583, CVE-2024-26584, CVE-2024-26585, CVE-2024-26586, CVE-2024-26593, CVE-2024-26602, CVE-2024-26609, CVE-2024-26633

CWE: 119, 125, 131, 190, 191, 20, 284, 300, 362, 393, 400, 401, 402, 404, 415, 416, 476, 770, 787, 99

RHSA: 2024:2394

Detections

Analytics