Important: kernel-rt security and bug fix update
Summary
ALSA-2023:4541: Important: kernel-rt security and bug fix update. Affects kernel-rt versions < 4.18.0-477.21.1.rt7.284.el8_8. Fixed in 4.18.0-477.21.1.rt7.284.el8_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the kernel-rt package:
-
CVE-2022-42896: A use-after-free vulnerability in the l2cap_connect and l2cap_le_connect_req functions of the net/bluetooth/l2cap_core.c file.
-
CVE-2023-1281: A use-after-free vulnerability in the tcindex traffic control index filter, allowing privilege escalation.
-
CVE-2023-1829: A use-after-free vulnerability in the Linux Kernel traffic control index filter.
-
CVE-2023-2235: A use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events.
-
CVE-2023-2124: An out-of-bounds access vulnerability in the XFS subsystem of the Linux kernel.
-
CVE-2023-2194: An out-of-bounds write vulnerability in the xgene_slimpro_i2c_xfer function of the i2c subsystem.
These vulnerabilities could lead to various security issues, including privilege escalation and arbitrary code execution.
How To Fix
Minimum fixed version
4.18.0-477.21.1.rt7.284.el8_8
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in the kernel-rt package. It is recommended to update the package to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for kernel-rt →
FAQ
These vulnerabilities could allow an attacker to escalate privileges, execute arbitrary code, or cause a denial of service.
At the time of this advisory, there are no known exploits for these vulnerabilities.
No specific workaround is mentioned in the advisory. It is recommended to update the kernel-rt package to the fixed version.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
