RHSA-2022:7933 Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: off-path attacker may inject data or terminate victim's TCP session kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: veth: ensure skb entering GRO are not cloned. kernel: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB kernel: smb2_ioctl_query_info NULL pointer dereference kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources kernel: kernel info leak issue in pfkey_register kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS kernel: fanotify misuses fd_install() which could lead to use-after-free kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() kernel: LoadPin bypass via dm-verity table reload kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() kernel: drm/amdkfd: NULL pointer dereference in kfd_parse_subtype_iolink() kernel: media: em28xx: initialize refcount before kref_get kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR) hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS) hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW) kernel: possible to use the debugger to write zero into a location of choice hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: AMD: Branch Type Confusion (non-retbleed) kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c hw: cpu: Intel: information disclosure via local access kernel: use after free in SUNRPC subsystem kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c kernel: nf_tables disallow binding to already bound chain kernel: netfilter: nfnetlink_osf: uninitialized variable information disclosure vulnerability kernel: ibmvnic: free reset-work-item when flushing kernel: iwlwifi: mvm: check debugfs_dir ptr before use kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head kernel: udmabuf: improper validation of array index leading to local privilege escalation
CVSS v3.1 score: 8.2