Important: kernel-rt security and bug fix update
Summary
ALSA-2023:4378: Important: kernel-rt security and bug fix update. Affects kernel-rt versions < 5.14.0-284.25.1.rt14.310.el9_2. Fixed in 5.14.0-284.25.1.rt14.310.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. This vulnerability affects the AlmaLinux:9 ecosystem.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the kernel-rt package:
-
CVE-2023-3090: An out-of-bounds write in the ipvlan module could be exploited by an attacker to execute arbitrary code.
-
CVE-2023-35788: An out-of-bounds write in the cls_flower module could allow an attacker to modify kernel memory.
-
CVE-2022-45869: A race condition in the KVM module's x86/mmu component could lead to privilege escalation.
-
CVE-2023-0458: A speculative pointer dereference in the do_prlimit() function in kernel/sys.c could result in a denial of service or information disclosure.
-
CVE-2023-1998: A vulnerability in the Spectre v2 SMT mitigations could allow an attacker to bypass these mitigations and potentially leak sensitive information.
How To Fix
Minimum fixed version
5.14.0-284.25.1.rt14.310.el9_2
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
This security and bug fix update addresses multiple vulnerabilities in the kernel-rt package. It is recommended to update the package to the specified version or later to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for kernel-rt →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code, modify kernel memory, escalate privileges, perform denial of service attacks, or leak sensitive information.
At the time of this advisory, there are no known exploits for these vulnerabilities.
Yes, a system restart is required after updating the kernel-rt package to ensure the fixes are applied.
These vulnerabilities require local access to the system to exploit.
For more details about these vulnerabilities, including the impact, CVSS scores, acknowledgments, and related information, refer to the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
