Affected: AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208) * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436) * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975) * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594) * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640) * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388) * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952) * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982) * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895) * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456) * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887) * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458) * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590) * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597) * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073) * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074) * kernel: hid: Use After Free in asus_rem…

Withdrawn by the publisher.

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite lo…

Affected: openEuler:22.03-LTS-SP1: kernel

The Linux Kernel, the operating system core itself. Security Fix(es): In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (CVE-2023-21255) (CVE-2023-2163) A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32248) VUL-0: CVE-2023-32255: kernel: Linux Kernel ksmbd Session Setup Memory Leak Denial-of-Service Vulnerability(CVE-2023-32255) A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information.(CVE-2023-3567) A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they…

kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: Rate limit overflow messages in r8152 in intr_callback kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: tun: avoid double free in tun_free_netdev kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c kernel: use-after-free due to race condition in qdisc_graft() kernel: x86/mm: Randomize per-cpu entry area kernel: HID: check empty report_list in hid_validate_values() kernel: sctp: fail if no bound addresses can be used for a given scope kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: hid: Use After Free in asus_remove() kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition kernel: hash collisions in the IPv6 connection lookup table kernel: ovl: fix use after free in struct ovl_aio_req kernel: denial of service in tipc_conn_close kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: U…

kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: Rate limit overflow messages in r8152 in intr_callback kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: tun: avoid double free in tun_free_netdev kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: memcg: fix possible use-after-free in memcg_write_event_control() kernel: char: tpm: Protect tpm_pm_suspend with locks kernel: ixgbevf: Fix resource leak in ixgbevf_init_module() kernel: mm/mempolicy: fix mpol_new leak in shared_policy_replace kernel: LSM: general protection fault in legacy_parse_param kernel: SUNRPC: Trap RDMA segment overflows kernel: mm/page_owner: use strscpy() instead of strlcpy() kernel: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags kernel: cipso: Fix data-races around sysctl. kernel: cgroup: Use separate src/dst nodes when preloading css_sets for migration kernel: tick/nohz: unexport __init-annotated tick_nohz_full_setup() kernel: device property: fix of nod…

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 141 more

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um seine Privilegien zu erhöhen.