Important: kernel-rt security and bug fix update
Summary
ALSA-2023:5091: Important: kernel-rt security and bug fix update. Affects kernel-rt versions < 5.14.0-284.30.1.rt14.315.el9_2. Fixed in 5.14.0-284.30.1.rt14.315.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the kernel-rt package:
- UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)
- Fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE in netfilter: nf_tables (CVE-2023-3610)
- Exploitable failure in tcf_change_indev function in net/sched: cls_fw component (CVE-2023-3776)
- Use-after-free due to improper element removal in nft_pipapo_remove() in netfilter (CVE-2023-4004)
- Use-after-free in nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID in netfilter (CVE-2023-4147)
- Use-after-free in nft_chain_lookup_byid() in nf_tables (CVE-2023-31248)
- Stack-out-of-bounds-read in nft_byteorder_eval() in nf_tables (CVE-2023-35001)
- Save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)
- Cross-Process Information Leak in hw: amd (CVE-2023-20593)
- Bypass of shadow stack protection due to a logic error in the kernel (CVE-2023-21102)
These vulnerabilities can lead to various security issues, including use-after-free, stack-out-of-bounds-read, and information leaks.
How To Fix
Minimum fixed version
5.14.0-284.30.1.rt14.315.el9_2
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in the kernel-rt package. It is recommended to update to the latest version to ensure the security and stability of your system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kernel-rt →
FAQ
These vulnerabilities can be exploited by attackers to execute arbitrary code, bypass security protections, or leak sensitive information.
The recommended mitigation is to update the kernel-rt package to the latest version, as it includes the necessary patches to address the vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the kernel-rt package to the latest version.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
