Issued:

2023-08-01

Updated:

2023-08-01

RHSA-2023:4377 - Important: kernel security, bug fix, and enhancement update

Synopsis

Important: kernel security, bug fix, and enhancement update

Type/Severity

Security Advisory Important

Topic

An update for kernel is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869)

• kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458)

• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• HPEMC RHEL 9 BUG: acpi-cpufreq: Skip initializtion if a cpufreq driver exists (BZ#2186562)

• RHEL 9.3: Update locking code to upstream 6.1 and further fixes (BZ#2187507)

• Getting "kernel: RIP: 0010:nvme_setup_discard+0x172/0x1e0 [nvme_core]" when I/O and DISCARD commands are sent to the file system on NVMe/TCP multipath device (BZ#2192632)

• RHEL 9.2 OS cannot boot successfully when enabling VMD in UEFI setup (BZ#2196230)

• Intel E810 card unable to create a MACVLAN on interface already configured as SRIOV (BZ#2209284)

• Trouble getting callstacks when signal has interrupted clock_gettime (BZ#2210074)

• DELL 9.3 BUG: HDMI/DP audio output device lost on some new wn21 series graphic card(Discrete mode). (BZ#2211656)

• DELL RHEL 9.2 BUG: Observed device_dax related probe errors in dmesg when HBM CPU is set to flat mode and creating duplicate device_dax ids and hence probe is failing (BZ#2212386)

• ice: The response of the "ubxtool -p " command may not correspond to the command: (BZ#2213186)

• Update lpfc 14.2.0.12 for RHEL 9.3 Inbox with three bug fixes from 14.2.0.13 (BZ#2213616)

• avoid unnecessary page fault retires on shared memory types (BZ#2213894)

• jitter: Fix RCT/APT health test during initialization (BZ#2215080)

• coretemp driver causes RDMSR interruption on isolated CPU (BZ#2215552)

• rbd: avoid fast-diff corruption in snapshot-based mirroring (BZ#2216569)

• Hyper-V RHEL-9: Fix VM crash/hang Issues due to fast VF add/remove events (BZ#2217066)

• OVS ERSPAN2: ip6erspan incorrect erspan version in GRE header (BZ#2217493)

• kernel-rt: system hung during stress-ng (BZ#2217939)

• kvm/sriov: high latency after soft reboot (BZ#2218871)

• CPU slushiness observed with lots of kworkers being created on host when more than 2 vm spawned in single shot (BZ#2218935)

• Wrong hwlat CPU affinity when started from a container. (BZ#2221157)

• cifs: check the lease context if we actually got a lease (BZ#2221159)

Enhancement(s):

• Intel 9.3 FEAT SPR power: Intel SST SNC4 support (BZ#2185605)

• Dell 9.3 Feat dell-wmi-privacy: The microphone still have function when press F4 Microphone Mute hotkey on Orchid Bay MLK (BZ#2209808)

• RFE: Support for a 'source-load-balancing' bonding mode (BZ#2221169)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

Updated Packages

• kernel-devel-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-zfcpdump-modules-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-core-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-modules-core-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-modules-extra-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-tools-5.14.0-284.25.1.el9_2.ppc64le.rpm
• perf-debuginfo-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-64k-debug-modules-extra-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-cross-headers-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-modules-core-5.14.0-284.25.1.el9_2.x86_64.rpm
• bpftool-debuginfo-7.0.0-284.25.1.el9_2.aarch64.rpm
• kernel-debuginfo-common-ppc64le-5.14.0-284.25.1.el9_2.ppc64le.rpm
• bpftool-7.0.0-284.25.1.el9_2.x86_64.rpm
• kernel-core-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-modules-core-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-abi-stablelists-5.14.0-284.25.1.el9_2.noarch.rpm
• kernel-debug-modules-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-headers-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-64k-modules-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-zfcpdump-core-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-64k-modules-extra-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-devel-matched-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-doc-5.14.0-284.25.1.el9_2.noarch.rpm
• kernel-modules-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-tools-libs-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-64k-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-headers-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-modules-core-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-tools-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-tools-5.14.0-284.25.1.el9_2.x86_64.rpm
• bpftool-7.0.0-284.25.1.el9_2.aarch64.rpm
• kernel-devel-5.14.0-284.25.1.el9_2.s390x.rpm
• perf-5.14.0-284.25.1.el9_2.aarch64.rpm
• python3-perf-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-devel-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-devel-matched-5.14.0-284.25.1.el9_2.aarch64.rpm
• perf-debuginfo-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-devel-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-5.14.0-284.25.1.el9_2.s390x.rpm
• python3-perf-debuginfo-5.14.0-284.25.1.el9_2.ppc64le.rpm
• bpftool-debuginfo-7.0.0-284.25.1.el9_2.x86_64.rpm
• kernel-64k-debug-devel-matched-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-core-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-64k-debug-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-devel-matched-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-zfcpdump-debuginfo-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-modules-core-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-zfcpdump-devel-matched-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-64k-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• perf-5.14.0-284.25.1.el9_2.x86_64.rpm
• bpftool-debuginfo-7.0.0-284.25.1.el9_2.s390x.rpm
• kernel-tools-libs-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-5.14.0-284.25.1.el9_2.src.rpm
• kernel-debug-modules-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-devel-matched-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-devel-5.14.0-284.25.1.el9_2.x86_64.rpm
• python3-perf-5.14.0-284.25.1.el9_2.s390x.rpm
• rtla-5.14.0-284.25.1.el9_2.aarch64.rpm
• bpftool-debuginfo-7.0.0-284.25.1.el9_2.ppc64le.rpm
• kernel-64k-debug-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-64k-devel-matched-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-cross-headers-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-zfcpdump-modules-core-5.14.0-284.25.1.el9_2.s390x.rpm
• perf-5.14.0-284.25.1.el9_2.ppc64le.rpm
• perf-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-tools-debuginfo-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-modules-extra-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-64k-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-core-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-devel-matched-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-modules-extra-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-modules-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-64k-devel-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-5.14.0-284.25.1.el9_2.x86_64.rpm
• bpftool-7.0.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-modules-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-uki-virt-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-devel-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-modules-core-5.14.0-284.25.1.el9_2.x86_64.rpm
• python3-perf-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-64k-debug-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-cross-headers-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debuginfo-common-aarch64-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-modules-extra-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-64k-modules-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-modules-extra-5.14.0-284.25.1.el9_2.aarch64.rpm
• bpftool-7.0.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-core-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debuginfo-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debuginfo-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-zfcpdump-devel-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-devel-5.14.0-284.25.1.el9_2.x86_64.rpm
• perf-debuginfo-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debuginfo-common-x86_64-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-tools-libs-devel-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-zfcpdump-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-tools-debuginfo-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-modules-extra-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-tools-debuginfo-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-headers-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-debuginfo-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-tools-libs-devel-5.14.0-284.25.1.el9_2.aarch64.rpm
• rtla-5.14.0-284.25.1.el9_2.s390x.rpm
• rtla-5.14.0-284.25.1.el9_2.ppc64le.rpm
• python3-perf-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-cross-headers-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-64k-debug-modules-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-headers-5.14.0-284.25.1.el9_2.aarch64.rpm
• perf-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• python3-perf-debuginfo-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-64k-debug-modules-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debuginfo-common-s390x-5.14.0-284.25.1.el9_2.s390x.rpm
• python3-perf-5.14.0-284.25.1.el9_2.x86_64.rpm
• rtla-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-devel-matched-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-devel-matched-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-modules-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-modules-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-modules-core-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-64k-debug-devel-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-zfcpdump-modules-extra-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-debug-debuginfo-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-modules-extra-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-tools-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-devel-matched-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-modules-extra-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-tools-5.14.0-284.25.1.el9_2.s390x.rpm
• kernel-modules-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-modules-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debuginfo-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-uki-virt-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debug-core-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-tools-libs-5.14.0-284.25.1.el9_2.aarch64.rpm
• kernel-debug-debuginfo-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-debuginfo-5.14.0-284.25.1.el9_2.ppc64le.rpm
• python3-perf-debuginfo-5.14.0-284.25.1.el9_2.x86_64.rpm
• kernel-tools-libs-devel-5.14.0-284.25.1.el9_2.ppc64le.rpm
• kernel-debug-devel-5.14.0-284.25.1.el9_2.aarch64.rpm

Fixes

• This content is not included.BZ - 2151317
• This content is not included.BZ - 2187257
• This content is not included.BZ - 2193219
• This content is not included.BZ - 2215768
• This content is not included.BZ - 2218672

CVEs

• CVE-2022-45869
• CVE-2023-0458
• CVE-2023-1998
• CVE-2023-3090
• CVE-2023-35788

References

• https://access.redhat.com/security/updates/classification/#important

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.