SB2022121620 - Red Hat Enterprise Linux 9.0 Extended Update Support update for kpatch-patch
Published: December 16, 2022 Updated: June 8, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2022-1158)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due the KVM implementation in Linux kernel does not properly perform guest page table updates in some situations. A remote user on the guest operating system can trigger memory corruption and perform a denial of service attack against the host OS.
2) Integer underflow (CVE-ID: CVE-2022-2639)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer underflow within the reserve_sfa_size() function in the openvswitch kernel module in Linux kernel. A local user can trigger an out-of-bounds read error and crash the system or escalate privileges.
3) Race condition (CVE-ID: CVE-2022-2959)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a missing lock in the pipe_resize_ring() function within the watch queue when performing operations on an object. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
4) Buffer overflow (CVE-ID: CVE-2022-43945)
The vulnerability allows a remote attacker to perform a denial of service attacl.
The vulnerability exists due to a boundary error within the Linux kernel NFSD implementation. A remote attacker can send the RPC message over TCP with garbage data added at the end of the message, trigger memory corruption and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.