CVE-2023-1252

A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.

A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly
• xen/netfront: disentangle tx_skb_freelist
• xen: sync include/xen/interface/io/ring.h with Xen's newest version
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation {CVE-2022-43945}
• mm/mremap: hold the rmap lock in write mode when moving page table entries. {CVE-2022-39189}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly {CVE-2022-23042}
• xen/netfront: disentangle tx_skb_freelist {CVE-2022-23042}
• xen: sync include/xen/interface/io/ring.h with Xen's newest version {CVE-2022-23042}
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• mac80211: do not accept/forward invalid EAPOL frames {CVE-2020-26139}
• bpf: Fix 32 bit src register truncation on div/mod {CVE-2021-3600}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
• net: prevent mss overflow in skb_segment() {CVE-2023-52435}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
• x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• x86: Clear .brk area at early boot {CVE-2022-36123}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
• net: rpl: fix rpl header size calculation {CVE-2023-2156}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
• nvmet-tcp: remove boilerplate code {CVE-2023-6356}
• nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
• nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
• net: tls, update curr on splice as well {CVE-2024-0646}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}…