Security features bypass in kernel (Red Hat package) - CVE-2022-1665

Vulnerability identifier: #VU71663

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1665

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to compromise the affected system.

The vulnerability exists due to missing secure boot lockdown patches applied to kernel. An attacker with physical access to device can bypass the secure boot validation and load non-trusted code on the system.

kernel (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support

Install updates from vendor's website.

kernel (Red Hat package) - update to 5.14.0-70.43.1.el9_0

• https://bugzilla.redhat.com/show_bug.cgi?id=2089529

• Red Hat Enterprise Linux 9.0 Extended Update Support update for kernel