Red Hat Enterprise Linux for Real Time 8.4 update for kernel-rt
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2021-0920 CVE-2022-0330 CVE-2022-0435 CVE-2022-22942 CVE-2021-4028 |
| CWE-ID | CWE-416 CWE-119 CWE-121 CWE-264 |
| Exploitation vector | Network |
| Public exploit |
Vulnerability #1 is being exploited in the wild. Vulnerability #4 is being exploited in the wild. |
| Vulnerable software Subscribe |
kernel-rt (Red Hat package) Operating systems & Components / Operating system package or component Red Hat Enterprise Linux for Real Time Operating systems & Components / Operating system Red Hat Enterprise Linux for Real Time for NFV Operating systems & Components / Operating system |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Use-after-free
EUVDB-ID: #VU59811
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2021-0920
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the unix_scm_to_skb() function of af_unix.c in Linux kernel. A local user can run a specially crafted program to trigger a race condition and execute arbitrary code with elevated privileges.
Install updates from vendor's website.
kernel-rt (Red Hat package): 4.18.0-305.7.1.rt7.79.el8_4 - 4.18.0-305.34.2.rt7.107.el8_4
Red Hat Enterprise Linux for Real Time: 8.4
Red Hat Enterprise Linux for Real Time for NFV: 8.4
External linkshttp://access.redhat.com/errata/RHSA-2022:0771
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
2) Buffer overflow
EUVDB-ID: #VU60988
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0330
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a random memory access flaw caused by a missing TLB flush in Linux kernel GPU i915 kernel driver functionality. A local user can execute arbitrary code on the system with elevated privileges.
Install updates from vendor's website.
kernel-rt (Red Hat package): 4.18.0-305.7.1.rt7.79.el8_4 - 4.18.0-305.34.2.rt7.107.el8_4
Red Hat Enterprise Linux for Real Time: 8.4
Red Hat Enterprise Linux for Real Time for NFV: 8.4
External linkshttp://access.redhat.com/errata/RHSA-2022:0771
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Stack-based buffer overflow
EUVDB-ID: #VU61216
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0435
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Linux kernel networking module for the Transparent Inter-Process Communication (TIPC) protocol. A remote unauthenticated attacker can send specially crafted traffic to the system, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the TIPC bearer is set up.
Install updates from vendor's website.
kernel-rt (Red Hat package): 4.18.0-305.7.1.rt7.79.el8_4 - 4.18.0-305.34.2.rt7.107.el8_4
Red Hat Enterprise Linux for Real Time: 8.4
Red Hat Enterprise Linux for Real Time for NFV: 8.4
External linkshttp://access.redhat.com/errata/RHSA-2022:0771
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU61217
Risk: Low
CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2022-22942
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error in the vmwgfx driver in Linux kernel. A local unprivileged user can gain access to files opened by other processes on the system through a dangling 'file' pointer.
Exploiting this vulnerability requires an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor.
Install updates from vendor's website.
kernel-rt (Red Hat package): 4.18.0-305.7.1.rt7.79.el8_4 - 4.18.0-305.34.2.rt7.107.el8_4
Red Hat Enterprise Linux for Real Time: 8.4
Red Hat Enterprise Linux for Real Time for NFV: 8.4
External linkshttp://access.redhat.com/errata/RHSA-2022:0771
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
5) Use-after-free
EUVDB-ID: #VU60797
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-4028
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the RDMA listen()
function in Linux kernel. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with elevated privileges.
Install updates from vendor's website.
kernel-rt (Red Hat package): 4.18.0-305.7.1.rt7.79.el8_4 - 4.18.0-305.34.2.rt7.107.el8_4
Red Hat Enterprise Linux for Real Time: 8.4
Red Hat Enterprise Linux for Real Time for NFV: 8.4
External linkshttp://access.redhat.com/errata/RHSA-2022:0771
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
