[Debian] High CVE: CVE-2023-3777/CVE-2023-4015/CVE-2023-4208/CVE-2023-4206/CVE-2023-4207/CVE-2023-3772/CVE-2022-45887/CVE-2022-45886/CVE-2022-45919/CVE-2023-3773/CVE-2023-21400 kernel: multiple CVEs

[Yue Tao]

CVE-2023-21400: https://nvd.nist.gov/vuln/detail/CVE-2023-21400

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-3773: https://nvd.nist.gov/vuln/detail/CVE-2023-3773

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

CVE-2023-3777: https://nvd.nist.gov/vuln/detail/CVE-2023-3777

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

CVE-2023-4015: https://nvd.nist.gov/vuln/detail/CVE-2023-4015

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.

CVE-2023-4208: https://nvd.nist.gov/vuln/detail/CVE-2023-4208

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.

CVE-2023-4206: https://nvd.nist.gov/vuln/detail/CVE-2023-4206

A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.

When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.

CVE-2023-4207: https://nvd.nist.gov/vuln/detail/CVE-2023-4207

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.

CVE-2023-3772: https://nvd.nist.gov/vuln/detail/CVE-2023-3772

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

CVE-2022-45887: https://nvd.nist.gov/vuln/detail/CVE-2022-45887

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.

CVE-2022-45886: https://nvd.nist.gov/vuln/detail/CVE-2022-45886

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.

CVE-2022-45919: https://nvd.nist.gov/vuln/detail/CVE-2022-45919

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

Base Score: High

Reference:

Upgrade Yocto Linux_5.10.192

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/kernel/+/897098

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/kernel/+/897098
Committed: https://opendev.org/starlingx/kernel/commit/b5cfde241158068978dfcb9f35dc3d0ef85560a8
Submitter: "Zuul (22348)"
Branch: master

commit b5cfde241158068978dfcb9f35dc3d0ef85560a8
Author: Peng Zhang <email address hidden>
Date: Tue Oct 10 10:40:02 2023 +0800

    Update kernel to v5.10.192

    This commit updates kernel to v5.10.192 to fix following CVE issues:
    CVE-2023-21400: https://nvd.nist.gov/vuln/detail/CVE-2023-21400
    CVE-2023-3773: https://nvd.nist.gov/vuln/detail/CVE-2023-3773
    CVE-2023-3777: https://nvd.nist.gov/vuln/detail/CVE-2023-3777
    CVE-2023-4015: https://nvd.nist.gov/vuln/detail/CVE-2023-4015
    CVE-2023-4208: https://nvd.nist.gov/vuln/detail/CVE-2023-4208
    CVE-2023-4206: https://nvd.nist.gov/vuln/detail/CVE-2023-4206
    CVE-2023-4207: https://nvd.nist.gov/vuln/detail/CVE-2023-4207
    CVE-2023-3772: https://nvd.nist.gov/vuln/detail/CVE-2023-3772
    CVE-2022-45887: https://nvd.nist.gov/vuln/detail/CVE-2022-45887
    CVE-2022-45886: https://nvd.nist.gov/vuln/detail/CVE-2022-45886
    CVE-2022-45919: https://nvd.nist.gov/vuln/detail/CVE-2022-45919.
    Also this commit fixes following CVE issues which can be fixed
    in v5.10.190.
    CVE-2022-45919: https://nvd.nist.gov/vuln/detail/CVE-2022-45919
    CVE-2023-20588: https://nvd.nist.gov/vuln/detail/CVE-2023-20588
    CVE-2023-35829: https://nvd.nist.gov/vuln/detail/CVE-2023-35829
    CVE-2023-35828: https://nvd.nist.gov/vuln/detail/CVE-2023-35828
    CVE-2023-35824: https://nvd.nist.gov/vuln/detail/CVE-2023-35824
    CVE-2023-35823: https://nvd.nist.gov/vuln/detail/CVE-2023-35823
    CVE-2023-2163: https://nvd.nist.gov/vuln/detail/CVE-2023-2163
    CVE-2023-34256: https://nvd.nist.gov/vuln/detail/CVE-2023-34256
    CVE-2022-39189: https://nvd.nist.gov/vuln/detail/CVE-2022-39189
    CVE-2022-4269: https://nvd.nist.gov/vuln/detail/CVE-2022-4269
    CVE-2023-1380: https://nvd.nist.gov/vuln/detail/CVE-2023-1380
    CVE-2023-2002: https://nvd.nist.gov/vuln/detail/CVE-2023-2002
    CVE-2023-21255: https://nvd.nist.gov/vuln/detail/CVE-2023-21255
    CVE-2023-2269: https://nvd.nist.gov/vuln/detail/CVE-2023-2269
    CVE-2023-31084: https://nvd.nist.gov/vuln/detail/CVE-2023-31084
    CVE-2023-3268: https://nvd.nist.gov/vuln/detail/CVE-2023-3268
    CVE-2023-3389: https://nvd.nist.gov/vuln/detail/CVE-2023-3389
    CVE-2023-34319: https://nvd.nist.gov/vuln/detail/CVE-2023-34319
    CVE-2023-4194: https://nvd.nist.gov/vuln/detail/CVE-2023-4194
    CVE-2023-4147: https://nvd.nist.gov/vuln/detail/CVE-2023-4147
    CVE-2023-4273: https://nvd.nist.gov/vuln/detail/CVE-2023-4273
    CVE-2022-40982: https://nvd.nist.gov/vuln/detail/CVE-2022-40982
    CVE-2023-4128: https://nvd.nist.gov/vuln/detail/CVE-2023-4128
    CVE-2023-40283: https://nvd.nist.gov/vuln/detail/CVE-2023-40283
    CVE-2023-1206: https://nvd.nist.gov/vuln/detail/CVE-2023-1206
    CVE-2023-0160: https://nvd.nist.gov/vuln/detail/CVE-2023-0160

    None of our source patches requires refresh against the new kernel
    source.

    Verification:
    - Build kernel and out of tree modules success for rt and std.
    - Bui...