ALSA-2022:7110 - Kernel Security, Bug Fix, and Enhancement Update
Summary
ALSA-2022:7110: Important: kernel security, bug fix, and enhancement update. Affects bpftool versions < 4.18.0-372.32.1.el8_6. Fixed in 4.18.0-372.32.1.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel packages contain the Linux kernel, which serves as the core of any Linux operating system. It provides essential functionality and interfaces for various hardware components and software applications.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the Linux kernel:
- Use-after-free in cls_route filter implementation (CVE-2022-2588): This vulnerability could be exploited to escalate privileges.
- Information leak in scsi_ioctl() (CVE-2022-0494): An attacker could exploit this vulnerability to obtain sensitive information.
- Kernel-info-leak issue in pfkey_register (CVE-2022-1353): This vulnerability could lead to information disclosure.
- RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900): These vulnerabilities could allow an attacker to execute arbitrary code.
- Branch Type Confusion (non-retbleed) (CVE-2022-23825): This vulnerability could be exploited to execute arbitrary code.
- RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901): This vulnerability could allow an attacker to execute arbitrary code.
For more details about these vulnerabilities, including their impact and CVSS scores, refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
4.18.0-372.32.1.el8_6
This is the first release that contains the fix.
sudo dnf update bpftoolTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in the Linux kernel. It is recommended to update the affected kernel packages to the latest version to mitigate the risk of exploitation. For more information and support, please contact DevNack.com.
See every vulnerability recorded for bpftool →
FAQ
These vulnerabilities could lead to privilege escalation, information disclosure, and arbitrary code execution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and the playground will analyze it for vulnerabilities.
No, there are no known workarounds for these vulnerabilities. It is recommended to update the affected kernel packages to the latest version.
Yes, you can find more information about these vulnerabilities, including their technical details and CVE identifiers, in the References section.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for bpftool.
