kernel-4.18.0-477.27.1.el8_8
エラータID: AXSA:2023-6444:26
リリース日:
2023/09/27 Wednesday - 05:55
題名:
kernel-4.18.0-477.27.1.el8_8
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- net/bluetooth/hci_sock.c で実装されている HCI ソケットには、権限
のチェック処理漏れの問題があるため、Bluetooth 通信が可能な近隣
の攻撃者により、細工した HCI パケットを介して、Bluetooth 通信の
管理コマンドの不正な実行やこれに起因する情報漏洩等を可能とする
脆弱性が存在します。(CVE-2023-2002)
- AMD 社製の Zen2 プロセッサには、ローカルの攻撃者により、
マイクロアーキテクチャ環境下において、情報の漏洩を可能とする
脆弱性が存在します。(CVE-2023-20593)
- ipvlan ドライバーには、ヒープ領域の範囲外書き込みの問題がある
ため、ローカルの攻撃者により、ローカルの権限昇格やサービス拒否
攻撃を可能とする脆弱性が存在します。(CVE-2023-3090)
- Netfilter サブシステムには、NFT_MSG_NEWRULE の誤った処理に
起因したメモリ領域の解放後利用の問題があるため、ローカルの攻撃者
により、特権昇格を可能とする脆弱性が存在します。(CVE-2023-3390)
- Netfilter の nft_byteorder() 関数には、ユーザーもしくはネットワーク
の名前空間上に CAP_NET_ADMIN 属性が設定されている場合、vm
レジスタを適切に処理できていないことに起因するメモリ領域の範囲外
アクセスの問題があるため、ローカルの攻撃者により、ローカルの権限
昇格を可能とする脆弱性が存在します。(CVE-2023-35001)
- TC (Traffic Control) flower クラスフィルタの fl_set_geneve_opt() 関数
には、メモリ領域の範囲外書き込みの問題があるため、ローカルの攻撃者
により、細工された TCA_FLOWER_KEY_ENC_OPTS_GENEVE パケット
の送信を介して、特権昇格やサービス拒否攻撃を可能とする脆弱性が存在
します。(CVE-2023-35788)
- net/sched/cls_fw.c の fw_set_parms() 関数には、tcf_change_indev()
関数が失敗した際に参照カウンタの操作後にエラーを返してしまうことに
起因したメモリ領域の解放後利用の問題があるため、ローカルの攻撃者
により、特権昇格を可能とする脆弱性が存在します。(CVE-2023-3776)
- Netfilter コンポーネントの nft_pipapo_remove() 関数には、メモリ
領域の解放後利用の問題があるため、ローカルの攻撃者により、
NFT_SET_EXT_KEY_END を設定せずに nft_pipapo_remove() 関数に
配列を引き渡すことを介して、特権昇格、およびサービス拒否攻撃
(クラッシュの発生) を可能とする脆弱性が存在します。(CVE-2023-4004)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-2002
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.
CVE-2023-20593
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
CVE-2023-3090
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.
CVE-2023-3390
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.
CVE-2023-35001
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
CVE-2023-35788
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.
CVE-2023-3776
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
CVE-2023-4004
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
追加情報:
N/A
ダウンロード:
SRPMS
- kernel-4.18.0-477.27.1.el8_8.src.rpm
MD5: 5d2a86cba957675e781a8654b0c6e617
SHA-256: b788bd607226ea9060830dda1d3f9d8b34f8f03862c76ec584e5fe2a4b88f58b
Size: 129.77 MB
Asianux Server 8 for x86_64
- bpftool-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: e9e5a2d55aea885b0d69db702e1e65a6
SHA-256: 8fc3b0c972cdf8b475283d132633b41fccd2655167aac36ff68e4df9d547d607
Size: 10.16 MB - kernel-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: f3b33c7226feaf4663dc8250fd0acf6c
SHA-256: 75f12060213c8e28acf8897146b7ec8456c1110a2378fd530a2a148682170577
Size: 9.40 MB - kernel-abi-stablelists-4.18.0-477.27.1.el8_8.noarch.rpm
MD5: 47e4bb53fcac38748bda3b8993db9ec6
SHA-256: af0b13c9c30cfe9245353b3a169a1d951872fb966c6b094793a2b271044346d4
Size: 9.42 MB - kernel-core-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: fa28674e33e6370ff498f31d823c7756
SHA-256: 1b9248f8b08f75afba00e6cf6a1dd8cd528348fd60a2b3c0a70b4d164cc9c85a
Size: 41.65 MB - kernel-cross-headers-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 03ac0e893d235912968adb5644dfea3b
SHA-256: e22cd8208bc03e7d3ab1900eab92e72b687db97326b0c2a56bd0ea21a3fd51ad
Size: 14.69 MB - kernel-debug-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 019b27f5cadfe11a9dc093f3e941d30f
SHA-256: a4403b4218f8182382bca7300e47a7dc25f8bf68b2147524b511c5de00105173
Size: 9.40 MB - kernel-debug-core-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 7532a984c783fa83453aedd76bad28f3
SHA-256: 363bbcd117445bebcf2f0296534efdddfb90365570128a5ce5bcfa32f2a9eba7
Size: 70.38 MB - kernel-debug-devel-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 1df92da3aa4512e61466a66c284b514b
SHA-256: fabe8c31f0022ab50bc3397a43410d586f79986447d16a4c64633f71feb2680f
Size: 23.09 MB - kernel-debug-modules-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 88be6298dc1e47aa4e2a9c41abbfb1de
SHA-256: aad5453629fdf43d968094851c5dd7199fa50e027caf3f59240dcecbc2502b27
Size: 63.37 MB - kernel-debug-modules-extra-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: d662c084ff1b8ead86d7db0de087cb90
SHA-256: a033d8f9aeeb76557a828e8bb8006cb92473902449cd07c29cf472bf5c0e350f
Size: 10.77 MB - kernel-devel-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 8d0c8ef5ae18a4c99c8d39c442e10b6d
SHA-256: 1b667947e7f6bad561b53f2082c9ef1427c832f5b90da09f029b14a951547baf
Size: 22.89 MB - kernel-doc-4.18.0-477.27.1.el8_8.noarch.rpm
MD5: 98a10699d916ef04d5331d61f583c685
SHA-256: a497dbee6d70bafdf599a4a0f3d6d9f18ef1d4442c5045622fc4e8f0177f97e7
Size: 27.09 MB - kernel-headers-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: f365a53cdbec80cdb55a08eca21aaa2d
SHA-256: b50921377d90d2111e306eb69209a17c89157e14b689f7dd9350e82cbae1200d
Size: 10.74 MB - kernel-modules-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 45c1583deed551f901f032230255c081
SHA-256: 23c2fe4fe3802cf0ca0a475574bc70769ac88eb6333d42c49ce4bfaa37d5c5e5
Size: 34.37 MB - kernel-modules-extra-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: ee02f535dfbfc58588e0feec96d54201
SHA-256: bad6da8b56bb41fd58c8db92490f96719aa5ddef4915e8ad81d84ddd17468350
Size: 10.08 MB - kernel-tools-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 476d37a46e9147655fc1a7f820bb4f9f
SHA-256: 04a4a0ccec11d5ca46c029fef595a1b81c003f08190a19017f04abf64118cd3c
Size: 9.62 MB - kernel-tools-libs-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 239ecee2b684c3246e529bada4559864
SHA-256: 52e8db17c9e7f2f766f8b5ad8e4ebfbe1b5f22acba5479cc5feadd1684cb256f
Size: 9.41 MB - kernel-tools-libs-devel-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 778a022668225062c9184a72cb84d8c4
SHA-256: ad4caa2751aef3634ac5ef5edd9400a1b1f7065a70ac896915513b6bd17afdb5
Size: 9.40 MB - perf-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: 6f1b3dd7175f67f0389335f5a6552053
SHA-256: d2c65bc88e1d896886a9541d36e8ed3e969b90059df6f34d9931e0b98a8b40cc
Size: 11.69 MB - python3-perf-4.18.0-477.27.1.el8_8.x86_64.rpm
MD5: c73d960bd02513b17fd0c53d6c6ae756
SHA-256: d00649e496461e3f2b1e125f06b6e25908680a9cbc3af2a6b75d83c0068c7120
Size: 9.53 MB
English