Описание
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201)
-
kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
-
kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
-
kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923)
-
kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961)
-
kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935)
-
kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383)
-
kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244)
-
kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472)
-
kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504)
-
kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904)
-
kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931)
-
kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960)
-
kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972)
-
kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977)
-
kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)
-
kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (CVE-2024-40998)
-
kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005)
-
kernel: xfs: don't walk off the end of a directory data block (CVE-2024-41013)
-
kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014)
-
kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
-
kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Связанные CVE
Ссылки на источники
Исправления
- Red Hat - 2268118
- Red Hat - 2270100
- Red Hat - 2275604
- Red Hat - 2277171
- Red Hat - 2278176
- Red Hat - 2278235
- Red Hat - 2282357
- Red Hat - 2293654
- Red Hat - 2296067
- Red Hat - 2297476
- Red Hat - 2297488
- Red Hat - 2297515
- Red Hat - 2297544
- Red Hat - 2297556
- Red Hat - 2297561
- Red Hat - 2297579
- Red Hat - 2297582
- Red Hat - 2297589
- Red Hat - 2300296
- Red Hat - 2300297
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
In the Linux kernel, the following vulnerability has been resolved: t ...