Important: Kernel Security and Bug Fix Update for AlmaLinux 9
Summary
ALSA-2023:3723: Important: kernel security and bug fix update. Affects bpftool versions < 7.0.0-284.18.1.el9_2. Fixed in 7.0.0-284.18.1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel is the core component of the Linux operating system. It provides essential functionality and interfaces for other software components to interact with the hardware. The kernel packages for AlmaLinux 9 contain the Linux kernel and are responsible for managing system resources, handling device drivers, and implementing security features.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the Linux kernel:
-
CVE-2023-2235: A use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events could be exploited to execute arbitrary code or escalate privileges.
-
CVE-2023-32233: A use-after-free vulnerability in nf_tables when processing batch requests could lead to privilege escalation.
-
CVE-2023-2002: Unauthorized management command execution in the Bluetooth subsystem could allow an attacker to execute arbitrary commands with elevated privileges.
-
CVE-2023-2124: An out-of-bounds access issue in the XFS subsystem could lead to information disclosure or denial of service.
-
CVE-2023-2194: An out-of-bounds write vulnerability in the i2c subsystem could be exploited to execute arbitrary code or cause a denial of service.
-
CVE-2023-28466: A race condition in the tls subsystem could result in a use-after-free or NULL pointer dereference, potentially leading to a system crash or arbitrary code execution.
These vulnerabilities could be exploited by remote attackers to gain unauthorized access, escalate privileges, or cause a denial of service.
How To Fix
Minimum fixed version
7.0.0-284.18.1.el9_2
This is the first release that contains the fix.
sudo dnf update bpftoolTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
This update addresses multiple security vulnerabilities in the Linux kernel for AlmaLinux 9. It is recommended to update the affected packages to the latest version to mitigate the risks associated with these vulnerabilities. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bpftool →
FAQ
These vulnerabilities could allow remote attackers to execute arbitrary code, escalate privileges, or cause a denial of service.
There are no known public exploits for these vulnerabilities at the time of this advisory.
Yes, a system restart is required after applying the kernel updates to ensure the new kernel version is loaded.
No additional steps are required after updating the kernel. However, it is recommended to perform thorough testing to ensure the system functions as expected.
More information about these vulnerabilities can be found in the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for bpftool.
