kernel-5.14.0-284.30.1.el9_2
エラータID: AXSA:2023-6421:25
リリース日:
2023/09/21 Thursday - 09:10
題名:
kernel-5.14.0-284.30.1.el9_2
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- x86 アーキテクチャの CPU の電源管理機能には、サイドチャネル
攻撃を許容してしまう問題があるため、ローカルの攻撃者により、
サスペンド状態からの復帰操作を介して、不正なメモリ領域への
アクセスを可能とする脆弱性が存在します。(CVE-2023-1637)
- AMD 社製の Zen2 プロセッサには、ローカルの攻撃者により、
マイクロアーキテクチャ環境下において、情報の漏洩を可能とする
脆弱性が存在します。(CVE-2023-20593)
- efi-rt-wrapper.S の __efi_rt_asm_wrapper ルーチンには、シャドウ
スタックの保護が迂回されてしまう問題があるため、ローカルの
攻撃者により、特権昇格を可能とする脆弱性が存在します。
(CVE-2023-21102)
- Netfilter の nft_chain_lookup_byid() 関数には、チェーンがアクティブ
であり、かつユーザーもしくはネットワークの名前空間において
CAP_NET_ADMIN 属性が設定されていることのチェック処理の欠落
に起因したメモリ領域の解放後利用の問題があるため、ローカルの
攻撃者により、ローカルの権限昇格を可能とする脆弱性が存在します。
(CVE-2023-31248)
- Netfilter サブシステムには、NFT_MSG_NEWRULE の誤った処理
に起因したメモリ領域の解放後利用の問題があるため、ローカルの
攻撃者により、特権昇格を可能とする脆弱性が存在します。
(CVE-2023-3390)
- Netfilter の nft_byteorder() 関数には、ユーザーもしくはネット
ワークの名前空間上に CAP_NET_ADMIN 属性が設定されている
場合、vm レジスタを適切に処理できていないことに起因するメモリ
領域の範囲外アクセスの問題があるため、ローカルの攻撃者により、
ローカルの権限昇格を可能とする脆弱性が存在します。
(CVE-2023-35001)
- Netfilter サブシステムの NFT_MSG_NEWRULE メッセージに
対するエラー処理には、メモリ領域の解放後利用の問題があるため、
CAP_NET_ADMIN 権限を持つローカルの攻撃者により、特権昇格
を可能とする脆弱性が存在します。(CVE-2023-3610)
- net/sched/cls_fw.c の fw_set_parms() 関数には、tcf_change_indev()
関数が失敗した際に参照カウンタの操作後にエラーを返してしまう
ことに起因したメモリ領域の解放後利用の問題があるため、ローカル
の攻撃者により、特権昇格を可能とする脆弱性が存在します。
(CVE-2023-3776)
- Netfilter コンポーネントの nft_pipapo_remove() 関数には、メモリ
領域の解放後利用の問題があるため、ローカルの攻撃者により、
NFT_SET_EXT_KEY_END を設定せずに nft_pipapo_remove() 関数
に配列を引き渡すことを介して、特権昇格、およびサービス拒否
攻撃 (クラッシュの発生) を可能とする脆弱性が存在します。
(CVE-2023-4004)
- Netfilter コンポーネントには、メモリ領域の解放後利用の問題が
あるため、ローカルの攻撃者により、NFTA_RULE_CHAIN_ID を
用いたルールの追加を介して、特権昇格、およびサービス拒否攻撃
(クラッシュの発生) を可能とする脆弱性が存在します。
(CVE-2023-4147)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-1637
A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks.
A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks.
CVE-2023-20593
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
CVE-2023-21102
In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-260821414References: Upstream kernel
In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-260821414References: Upstream kernel
CVE-2023-31248
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
CVE-2023-3390
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.
CVE-2023-35001
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
CVE-2023-3610
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.
CVE-2023-3776
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
CVE-2023-4004
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
CVE-2023-4147
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
追加情報:
N/A
ダウンロード:
SRPMS
- kernel-5.14.0-284.30.1.el9_2.src.rpm
MD5: 8dc572da870666a6ffd85e62c77fa366
SHA-256: d8d08a6568176539692fca4e5e50d13a47f9658d6a0a4904cfc371bfb7cde709
Size: 138.39 MB
Asianux Server 9 for x86_64
- bpftool-7.0.0-284.30.1.el9_2.x86_64.rpm
MD5: c2206599b7c8867a147f465347eb9ceb
SHA-256: 8abbe7ed40338c23f2cd5bcc6394273abbebbf07898c66159a87173fa394f25b
Size: 4.14 MB - kernel-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 0b015f76c39ec9992ec0b2a6fec26feb
SHA-256: f92448b128824d21b22f743f9a16b142d548e8271e07d33707d6d599c2e01382
Size: 3.39 MB - kernel-abi-stablelists-5.14.0-284.30.1.el9_2.noarch.rpm
MD5: 2c383fbe6a939ba0da8e2da3d4d3de5f
SHA-256: 9065db926bc84f58ad5cd5555d18f6aebbd305e3778dedef8b0878fd73f8ef94
Size: 3.40 MB - kernel-core-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: a3456af77ed01fd74215817ecbe53e09
SHA-256: 5f4f529083ed0df78686cb4a713eb339d6dbb53028c20901049fed021bce506c
Size: 16.60 MB - kernel-cross-headers-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: d6564c80529e206d2b1ffb3911d93ded
SHA-256: bb4e6dde1e56f483292a2caa286fd9d89c14690be1a4cc22fc7c23f87ec4753f
Size: 8.96 MB - kernel-debug-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 180796d0e53e04d678d61a9dee134a06
SHA-256: 09a4992179664254a4e92c8f95989425390774505779b5a7893e67c23a168344
Size: 3.39 MB - kernel-debug-core-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 48d55dcd443bf78fe31de185c95c0897
SHA-256: 50dc98c06354567401b502450b6e25d664a5595f4ec09b7e8f81006e57bf4119
Size: 27.65 MB - kernel-debug-devel-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 7d5a958164c4dcadbbd29053216a82b7
SHA-256: 87151c3c5305976f09046abf7900fc09a04997f42def5891201624733c0ebab2
Size: 18.58 MB - kernel-debug-devel-matched-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 8787fc41aaf8f39f46c63af27feedc0a
SHA-256: d6afcb339e81e763dc7d27e9c77c70942feeafc771f8568f7a085fc256f99b7e
Size: 3.39 MB - kernel-debug-modules-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 0feef1ad75e91558488924fa7efd9d66
SHA-256: 1c7123f67707ad4ab46e3e79d73cf6223a51d5360254bc510859cb3f63e3f8ed
Size: 58.53 MB - kernel-debug-modules-core-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 6bf0901d6f2ecf18a3b83a5c4b6783d1
SHA-256: f71923af31027fcdef1690234b43e89410a056838e0e1306eaf962e2787c1eaf
Size: 50.46 MB - kernel-debug-modules-extra-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: d2ab12c561d8c60a4995de51f45aee30
SHA-256: 2efd176dd3c20c05c5096e3d3aaf724873322197ca05f259cf256227b99fa8b0
Size: 4.40 MB - kernel-debug-uki-virt-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 3a14db2aadc2cf3db6be66a0dd3f5b64
SHA-256: d10d0e9c856ea3194857280da963c3f45201c93b58927526ca0566fa6fcae9ae
Size: 71.74 MB - kernel-devel-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 270b06b088f13118b60cf413b9b97ce1
SHA-256: 1380777a3edfbe3c10634e7881f6188256d467e420ae9381810bf00cec43addc
Size: 18.59 MB - kernel-devel-matched-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 72d892dcc236ef723dd37e19853a1220
SHA-256: ec68637854f071bbb2fa9a31acf922386302708bae0668b779d43345faf8f4cc
Size: 3.39 MB - kernel-doc-5.14.0-284.30.1.el9_2.noarch.rpm
MD5: 5eef65ec2b9dd8b05524b11435ffcbcd
SHA-256: 43645a687cca317bca747fd335bea70adb84c088071e62cbbbf17109f792deb6
Size: 31.83 MB - kernel-headers-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: f3f99b4bbcc83cd8395c836fb6f7c878
SHA-256: 6e95c2e58d203e67698054d0cd18bed5932662aafed41ec43a0a3be38d26b941
Size: 4.80 MB - kernel-modules-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 31aabe656d6ab63830aba634b503063a
SHA-256: a77a7f36bbe10669930e90be2126b7878aae7b3bed37586aae623ccfe11ab287
Size: 37.19 MB - kernel-modules-core-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 1ba4054b9b815ec9d3688cdc8117486c
SHA-256: 416e6d3a16d5868e6635a618e9141627e9e35124ad656d9eb6fa221627b5abfc
Size: 35.41 MB - kernel-modules-extra-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: dc57ad833862780f71371652c9475f10
SHA-256: 98b2504656ced01c7f9fecb942c2c76e7c4cd4ed3615bf7be404c0e9081ca1ea
Size: 4.06 MB - kernel-tools-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 90457cf687e8fcc7fe52eaa37aacd6bd
SHA-256: 77b8d61772e613950b365c4df24ba4256251a498df7bf268aa68c2cde9211b1d
Size: 3.61 MB - kernel-tools-libs-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 09238793405eaecfb7c1ca82fb0f29bc
SHA-256: 323e9fb9a6be1a1f2e87b6e2964736372e6adfeb54e1b8cb9488a4ae560f01c4
Size: 3.40 MB - kernel-tools-libs-devel-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 7e28c562f4bf5368a097500993fcdb74
SHA-256: 60e0f2cf7761b8961ab3f1d1ff74e01df334cf5841769a3b6bd90fd72c40d421
Size: 3.39 MB - kernel-uki-virt-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: c60cb641b9e477a86d06ad41abfe1ddb
SHA-256: 2b90a68ab068d93de951655f8bc3db1a6a8a74e655614a566efd74c3d2039b48
Size: 53.74 MB - perf-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: b1ee0bd0e239e62c123e3588df3c5e20
SHA-256: aabfb29e2cbbe7787ef0db1f85f6fe07224ea7890155f4892a8613a439b96ddc
Size: 5.78 MB - python3-perf-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: 071391a661d8749b390fd0e95fe90eda
SHA-256: 55ccd4222d944b62bca47cf37eb6d9eeb71d0f310d248577a79c9fa0c72eabf5
Size: 3.52 MB - rtla-5.14.0-284.30.1.el9_2.x86_64.rpm
MD5: c4cd6cbc14ce85300512b1348cd3bc4e
SHA-256: 9d6b63b50fd7723ac11eeeeda7c1cc9d3ff0c4d8cf3a76d934bed6ecc9a4c0c6
Size: 3.42 MB
English