Rocky Linux: RLSA-2023:5091 kernel-rt security and bug fix update
Summary
An update is available for kernel-rt. This update affects Rocky Linux 9. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390) * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610) * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776) * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004) * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147) * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248) * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001) * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637) * hw: amd: Cross-Process Information Leak (CVE-2023-20593) * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel-rt: update RT source tree to the latest Rocky Linux-9.2.z3 Batch (BZ#2228482)
RPMs
kernel-rt-0:5.14.0-284.30.1.rt14.315.el9_2.src.rpm
kernel-rt-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-core-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-core-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-debuginfo-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-devel-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debuginfo-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-kvm-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-modules-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-modules-core-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-debug-modules-extra-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-devel-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-kvm-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-modules-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-modules-core-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
kernel-rt-modules-extra-0:5.14.0-284.30.1.rt14.315.el9_2.x86_64.rpm
References
No References
CVEs
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1637
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20593
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21102
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31248
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3390
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35001
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3610
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3776
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4004
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4147
Fixes
https://bugzilla.redhat.com/show_bug.cgi?id=2181891
https://bugzilla.redhat.com/show_bug.cgi?id=2213260
https://bugzilla.redhat.com/show_bug.cgi?id=2213455
https://bugzilla.redhat.com/show_bug.cgi?id=2217845
https://bugzilla.redhat.com/show_bug.cgi?id=2220892
https://bugzilla.redhat.com/show_bug.cgi?id=2220893
https://bugzilla.redhat.com/show_bug.cgi?id=2225097
https://bugzilla.redhat.com/show_bug.cgi?id=2225198
https://bugzilla.redhat.com/show_bug.cgi?id=2225239
https://bugzilla.redhat.com/show_bug.cgi?id=2225275