huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-48760: kernel: USB: core: Fix hang in usb_kill_urb by adding memory barriers
Component: kernel
Severity: Low
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix hang in usb_kill_urb by adding memory barriers

The syzbot fuzzer has identified a bug in which processes hang waiting
for usb_kill_urb() to return.  It turns out the issue is not unlinking
the URB; that works just fine.  Rather, the problem arises when the
wakeup notification that the URB has completed is not received.

The reason is memory-access ordering on SMP systems.  In outline form,
usb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on
different CPUs perform the following actions:

CPU 0					CPU 1
----------------------------		---------------------------------
usb_kill_urb():				__usb_hcd_giveback_urb():
  ...					  ...
  atomic_inc(&urb->reject);		  atomic_dec(&urb->use_count);
  ...					  ...
  wait_event(usb_kill_urb_queue,
	atomic_read(&urb->use_count) == 0);
					  if (atomic_read(&urb->reject))
						wake_up(&usb_kill_urb_queue);

Confining your attention to urb->reject and urb->use_count, you can
see that the overall pattern of accesses on CPU 0 is:

	write urb->reject, then read urb->use_count;

whereas the overall pattern of accesses on CPU 1 is:

	write urb->use_count, then read urb->reject.

This pattern is referred to in memory-model circles as SB (for "Store
Buffering"), and it is well known that without suitable enforcement of
the desired order of accesses -- in the form of memory barriers -- it
is entirely possible for one or both CPUs to execute their reads ahead
of their writes.  The end result will be that sometimes CPU 0 sees the
old un-decremented value of urb->use_count while CPU 1 sees the old
un-incremented value of urb->reject.  Consequently CPU 0 ends up on
the wait queue and never gets woken up, leading to the observed hang
in usb_kill_urb().

The same pattern of accesses occurs in usb_poison_urb() and the
failure pathway of usb_hcd_submit_urb().

The problem is fixed by adding suitable memory barriers.  To provide
proper memory-access ordering in the SB pattern, a full barrier is
required on both CPUs.  The atomic_inc() and atomic_dec() accesses
themselves don't provide any memory ordering, but since they are
present, we can use the optimized smp_mb__after_atomic() memory
barrier in the various routines to obtain the desired effect.

This patch adds the necessary memory barriers.


Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 4.14.265, 4.19.228, 4.4.302, 4.9.300, 5.10.96, 5.15.19, 5.16.5, 5.17, 5.4.176
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5f138ef224dffd15d5e5c5b095859719e0038427
CVE-2022-48765: kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-20T00:00:00+00:00

A vulnerability was found in the Linux kernel's KVM component related to the LAPIC during the guest reboot process. This issue arises when the SET_LAPIC command is issued without exposing the tsc-deadline mode, leading to warnings and potential inconsistencies due to an unhandled preemption timer. This situation can disrupt the normal operation of virtual machines.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 5.15.19, 5.16.5, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 54b3439c8e70e0bcfea59aeef9dd98908cbbf655
CVE-2022-48771: kernel: drm/vmwgfx: Fix stale file descriptors on failed usercopy
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-06-20T00:00:00+00:00

A use-after-free vulnerability has been identified in the Linux kernel's VMware graphics driver (vmwgfx) driver. This flaw occurs during the usercopy operation for the fence_rep object. If this operation fails, it can leave a stale (dangling) file descriptor in the system's file descriptor table. This allows userland processes to reference an invalidated file object, ultimately leading to a use-after-free condition. Successful exploitation of this vulnerability could result in memory corruption, system instability, or a denial of service.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 4.14.264, 4.19.227, 5.10.95, 5.15.18, 5.16.4, 5.17, 5.4.175
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e8d092a62449dcfc73517ca43963d2b8f44d0516
CVE-2022-48773: kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A flaw was found in the Linux kernel in which a system crash can occur if there are certain errors establishing RPC-over-RDMA connections.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.102, 5.15.25, 5.16.11, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1e7433fb95ccc01629a5edaa4ced0cd8c98d0ae0
CVE-2022-48786: kernel: vsock: remove vsock from connected table when connect is interrupted by a signal
Component: kernel
Severity: Moderate
CWE: CWE-464 (Addition of Data Structure Sentinel)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's vsock subsystem's vsock_stream_connect() function where improper handling of the socket state can lead to the connected table's list being corrupted. This occurs when a signal interrupt occurs and resets the socket's state without removing it from the connected table; the process then attempts the connect() function again, which if successful, can lead to the socket being added a second time to the connected table, corrupting the linked list structure used for managing connected sockets. This vulnerability can potentially lead to memory corruption and system instability.

Statement: This issue is fixed in RHEL-9.1 and above
~~~
in (rhel-8.7, rhel-8.8, rhel-8.9, rhel-8.10) vsock: remove vsock from connected table when connect is interrupted by a signal
in (rhel-9.1, rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) vsock: remove vsock from connected table when connect is interrupted by a signal
~~~

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 4.14.268, 4.19.231, 4.9.303, 5.10.102, 5.15.25, 5.16.11, 5.17, 5.4.181
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0bb88f3f7e8d506f3efe46d694964117e20efbfc
CVE-2022-48793: kernel: KVM: x86: nSVM: fix potential NULL derefernce on nested migration
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the nested.c file in the Linux kernel's KVM driver, where a potential NULL dereference can occur. This happens when the call to load the nested state is executed before Nested Page Tables (NPT) are enabled, preventing access to guest memory, lead to system instability and a denial of service during nested migration processes.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.25, 5.16.11, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 74b426bea4f7e3b081add2b88d4fba16d3af7ab6
CVE-2022-48796: kernel: iommu: Fix potential use-after-free during probe
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's IOMMU driver, where the dev_iommu_free function can lead to a use-after-free error. This occurs when a device probe fails while simultaneously accessing dev->iommu->fwspec in the of_iommu_configure path. As a result, this vulnerability can potentially cause system instability or crashes.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.101, 5.15.24, 5.16.10, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cb86e511e78e796de6947b8f3acca1b7c76fb2ff
CVE-2022-48799: kernel: perf: Fix list corruption in perf_cgroup_switch()
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's performance monitoring subsystem, where the perf_cgroup_switch() function can lead to list corruption on the cgrp_cpuctx_list. This occurs during the iteration of the list when an entry is removed using perf_cgroup_event_disable, which does not safely handle the modification. The impact of this vulnerability can cause instability and unexpected behavior in performance monitoring events.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.14.267, 4.19.230, 5.10.101, 5.15.24, 5.16.10, 5.17, 5.4.180
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5d76ed4223403f90421782adb2f20a9ecbc93186
CVE-2022-48804: kernel: vt_ioctl: fix array_index_nospec in vt_setactivate
Component: kernel
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's vt_ioctl subsystem, where the vt_setactivate function can lead to a transient integer underflow due to improper handling of the vsa.console value. The vulnerability arises when an out-of-bounds value is decreased before being sanitized using array_index_nospec. This can potentially allow unauthorized access or manipulation of memory.


Affected upstream versions: 4.9.130 < 4.9.302, 4.14.73 < 4.14.267, 3.16.62 < 3.17, 4.4.159 < 4.5, 4.18.11 < 4.19, 4.19
Fixed upstream versions: 0, 3.17, 4.14.267, 4.19, 4.19.230, 4.5, 4.9.302, 5.10.101, 5.15.24, 5.16.10, 5.17, 5.4.180
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 830c5aa302ec16b4ee641aec769462c37f802c90
CVE-2022-48816: kernel: SUNRPC: lock against -&gt;sock changing during sysfs read
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's SUNRPC component, where a race condition exists during sysfs read operations due to improper handling of the ->sock pointer. If the mutex ->recv_mutex is not held, ->sock may change asynchronously, leading to a potential kernel oops. This vulnerability can result in system instability and crashes during network operations.


Affected upstream versions: 5.10.67 < 5.11, 5.13.19 < 5.14, 5.14
Fixed upstream versions: 0, 5.11, 5.14, 5.15.209, 5.16.10, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fdc42287ae3f8a35cc2098307f52d7864b4bc8ed
CVE-2022-48827: kernel: NFSD: Fix the behavior of READ near OFFSET_MAX
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's NFSD, where improper handling of read requests near the maximum offset can lead to an integer overflow. When a client attempts to read from a near-maximum offset, it causes the server to return an invalid NFS error, resulting in indefinite retries by the client. This behavior can disrupt file access and stability in networked environments.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.220, 5.15.24, 5.16.10, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1726a39b0879acfb490b22dca643f26f4f907da9
CVE-2022-48828: kernel: NFSD: Fix ia_size underflow
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's NFSD, where an underflow in the ia_size field can occur due to incorrect handling of file size types. When an NFS client sends a file size greater than the maximum value the system can handle, it can lead to an underflow in the ia_size variable, causing unpredictable behavior. This vulnerability impacts the integrity and reliability of file operations in NFS.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.220, 5.15.24, 5.16.10, 5.17, 5.4.295
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d2211e6e34d0755f35e2f8c22d81999fa81cfc71
CVE-2022-48829: kernel: NFSD: Fix NFSv3 SETATTR/CREATE&#39;s handling of large file sizes
Component: kernel
Severity: Moderate
CWE: CWE-253 (Incorrect Check of Function Return Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the Linux kernel's NFSD, specifically in the handling of large file sizes during NFSv3 SETATTR and CREATE operations. The ia_size field, being a signed 64-bit type, can lead to unexpected behavior when clients send size values larger than the maximum allowed. This improper handling can result in silent value capping, potentially leading to data corruption in file size management.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.220, 5.15.24, 5.16.10, 5.17, 5.4.295
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 72c14aed6838b5d90b4dd926b6a339b34bb02e08
CVE-2022-4883: libXpm: compression commands depend on $PATH
Component: libXpm
Severity: Important
CWE: CWE-426 (Untrusted Search Path)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-17T00:00:00+00:00

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.

Statement: Red Hat Enterprise Linux 6 is affected but out of support scope because libXpm is not listed in Red Hat Enterprise Linux 6 ELS Inclusion List[1].

[1]. https://access.redhat.com/articles/4997301

Affected upstream versions: 3.5.15
Fixed upstream versions: libXpm-3.5.15
Upstream repository: https://gitlab.freedesktop.org/xorg/lib/libxpm
Upstream fix commit: 515294bb8023a45ff91669
CVE-2022-48830: kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A potential CAN frame reception race flaw was found in isotp_rcv() in the Linux kernel. This vulnerability may lead to a crash.


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.101, 5.15.24, 5.16.10, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7b53d2204ce79b27a878074a77d64f40ec21dbca
CVE-2022-48836: kernel: Input: aiptek - properly check endpoint type
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A wrong endpoint type warning was recorded in usb_submit_urb() in the Linux kernel. This may present a potential loss of Availability.


Affected upstream versions: 3.2.79 < 3.3, 3.12.53 < 3.13, 4.4
Fixed upstream versions: 0, 3.13, 3.3, 4.14.273, 4.19.236, 4.9.308, 5.10.108, 5.15.31, 5.16.17, 5.17, 5.4.187
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 57277a8b5d881e02051ba9d7f6cb3f915c229821
CVE-2022-48866: kernel: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

A vulnerability was found in the thrustmaster_interrupts function in the Linux kernel's HID Thrustmaster driver. This issue arises from a lack of validation for the actual number of endpoints, leading to a slab-out-of-bounds read when the code accesses the endpoint array.

Statement: Red Hat Enterprise Linux version 9.1 and greater include the relevant patch (fc3ef2e3297b) and are therefore unaffected.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.29, 5.16.15, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3ffbe85cda7f523dad896bae08cecd8db8b555ab
CVE-2022-48883: kernel: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent
Component: kernel
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-08-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent

A user is able to configure an arbitrary number of rx queues when
creating an interface via netlink. This doesn't work for child PKEY
interfaces because the child interface uses the parent receive channels.

Although the child shares the parent's receive channels, the number of
rx queues is important for the channel_stats array: the parent's rx
channel index is used to access the child's channel_stats. So the array
has to be at least as large as the parent's rx queue size for the
counting to work correctly and to prevent out of bound accesses.

This patch checks for the mentioned scenario and returns an error when
trying to create the interface. The error is propagated to the user.

Statement: This issue is fixed in RHEL-9.2 and above (including RHEL 8.10)
~~~
in (rhel-8.8, rhel-8.9, rhel-8.10) net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent
in (rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent
~~~

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.7, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5844a46f09f768da866d6b0ffbf1a9073266bf24
CVE-2022-48884: kernel: net/mlx5: Fix command stats access after free
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-08-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix command stats access after free

Command may fail while driver is reloading and can't accept FW commands
till command interface is reinitialized. Such command failure is being
logged to command stats. This results in NULL pointer access as command
stats structure is being freed and reallocated during mlx5 devlink
reload (see kernel log below).

Fix it by making command stats statically allocated on driver probe.

Kernel log:
[ 2394.808802] BUG: unable to handle kernel paging request at 000000000002a9c0
[ 2394.810610] PGD 0 P4D 0
[ 2394.811811] Oops: 0002 [#1] SMP NOPTI
...
[ 2394.815482] RIP: 0010:native_queued_spin_lock_slowpath+0x183/0x1d0
...
[ 2394.829505] Call Trace:
[ 2394.830667]  _raw_spin_lock_irq+0x23/0x26
[ 2394.831858]  cmd_status_err+0x55/0x110 [mlx5_core]
[ 2394.833020]  mlx5_access_reg+0xe7/0x150 [mlx5_core]
[ 2394.834175]  mlx5_query_port_ptys+0x78/0xa0 [mlx5_core]
[ 2394.835337]  mlx5e_ethtool_get_link_ksettings+0x74/0x590 [mlx5_core]
[ 2394.836454]  ? kmem_cache_alloc_trace+0x140/0x1c0
[ 2394.837562]  __rh_call_get_link_ksettings+0x33/0x100
[ 2394.838663]  ? __rtnl_unlock+0x25/0x50
[ 2394.839755]  __ethtool_get_link_ksettings+0x72/0x150
[ 2394.840862]  duplex_show+0x6e/0xc0
[ 2394.841963]  dev_attr_show+0x1c/0x40
[ 2394.843048]  sysfs_kf_seq_show+0x9b/0x100
[ 2394.844123]  seq_read+0x153/0x410
[ 2394.845187]  vfs_read+0x91/0x140
[ 2394.846226]  ksys_read+0x4f/0xb0
[ 2394.847234]  do_syscall_64+0x5b/0x1a0
[ 2394.848228]  entry_SYSCALL_64_after_hwframe+0x65/0xca

Statement: This issue is fixed in RHEL-9.2 and above (including RHEL 8.10)
~~~
bf13eb7f6314 (in rhel-8.8, rhel-8.9, rhel-8.10) net/mlx5: Fix command stats access after free
fb03f081910b (in rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) net/mlx5: Fix command stats access after free
~~~

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.7, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ddf458641a511e7dff19f3bf0cbbc5dd9fe08ce5
CVE-2022-48885: kernel: ice: Fix potential memory leak in ice_gnss_tty_write()
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix potential memory leak in ice_gnss_tty_write()

The ice_gnss_tty_write() return directly if the write_buf alloc failed,
leaking the cmd_buf.

Fix by free cmd_buf if write_buf alloc failed.

Statement: This issue is fixed in RHEL-9.2 and above
~~~
8cb1cac4610d (in rhel-9.2, rhel-9.3, rhel-9.4, rhel-9.5) ice: Fix potential memory leak in ice_gnss_tty_write()
~~~

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.7, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 500ca1da9d0876244eb4d1b0ece6fa0e9968d45d
CVE-2022-48904: kernel: iommu/amd: Fix I/O page table memory leak
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix I/O page table memory leak

The current logic updates the I/O page table mode for the domain
before calling the logic to free memory used for the page table.
This results in IOMMU page table memory leak, and can be observed
when launching VM w/ pass-through devices.

Fix by freeing the memory used for page table before updating the mode.

Statement: This issue is fixed in RHEL-8.6 and above (including RHEL 8.10)
~~~
in (rhel-8.6, rhel-8.7, rhel-8.8, rhel-8.9, rhel-8.10) iommu/amd: Fix I/O page table memory leak
~~~

Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.27, 5.16.13, 5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 378e2fe1eb58d5c2ed55c8fe5e11f9db5033cdd6