Moderate: kernel-rt security and bug fix update
Summary
ALSA-2022:6002: Moderate: kernel-rt security and bug fix update. Affects kernel-rt versions < 5.14.0-70.22.1.rt21.94.el9_0. Fixed in 5.14.0-70.22.1.rt21.94.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. This vulnerability affects the AlmaLinux 9 ecosystem.
Vulnerability Detail
This vulnerability includes two security fixes:
-
Information leak in scsi_ioctl(): This vulnerability, identified as CVE-2022-0494, allows an attacker to leak sensitive information through the scsi_ioctl() function.
-
Use-after-free in tc_new_tfilter() in net/sched/cls_api.c: This vulnerability, identified as CVE-2022-1055, allows an attacker to exploit a use-after-free issue in the tc_new_tfilter() function, potentially leading to arbitrary code execution.
For more details about the security issues, including the impact and CVSS scores, refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
5.14.0-70.22.1.rt21.94.el9_0
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for this vulnerability.
Conclusion
In conclusion, this vulnerability affects the kernel-rt package in the AlmaLinux 9 ecosystem. It includes two security fixes addressing information leak and use-after-free vulnerabilities. To mitigate the risk, it is recommended to update the kernel-rt package to version 5.14.0-70.22.1.rt21.94.el9_0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kernel-rt →
FAQ
The information leak vulnerability (CVE-2022-0494) allows an attacker to access sensitive information, potentially leading to further exploitation or unauthorized access.
The use-after-free vulnerability (CVE-2022-1055) can be exploited by an attacker to execute arbitrary code, potentially gaining full control over the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for any open-source vulnerabilities.
The recommended mitigation is to update the kernel-rt package to the fixed version mentioned above. This will ensure that the necessary security patches are applied to address the vulnerabilities.
You can find more information about these vulnerabilities, including the impact, CVSS scores, and acknowledgments, on the respective CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
