Linux · Security advisory · October 25, 2022

ALSA-2022:7110: Security update for 20 packages

ALSA-2022:7110, released October 25, 2022, fixes 7 CVEs across 20 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0587

93rd percentile

Priority of the 7 CVEs

Patch now 0
                                Urgent 0
                                High 7
                                Routine 0

Fixed package versions

Product	Release	Fixed in
bpftool	almalinux 8	4.18.0-372.32.1.el8_6
kernel	almalinux 8	4.18.0-372.32.1.el8_6
kernel-abi-stablelists	almalinux 8	4.18.0-372.32.1.el8_6
kernel-core	almalinux 8	4.18.0-372.32.1.el8_6
kernel-cross-headers	almalinux 8	4.18.0-372.32.1.el8_6
kernel-debug	almalinux 8	4.18.0-372.32.1.el8_6
kernel-debug-core	almalinux 8	4.18.0-372.32.1.el8_6
kernel-debug-devel	almalinux 8	4.18.0-372.32.1.el8_6
kernel-debug-modules	almalinux 8	4.18.0-372.32.1.el8_6
kernel-debug-modules-extra	almalinux 8	4.18.0-372.32.1.el8_6
kernel-devel	almalinux 8	4.18.0-372.32.1.el8_6
kernel-doc	almalinux 8	4.18.0-372.32.1.el8_6
kernel-headers	almalinux 8	4.18.0-372.32.1.el8_6
kernel-modules	almalinux 8	4.18.0-372.32.1.el8_6
kernel-modules-extra	almalinux 8	4.18.0-372.32.1.el8_6
kernel-tools	almalinux 8	4.18.0-372.32.1.el8_6
kernel-tools-libs	almalinux 8	4.18.0-372.32.1.el8_6
kernel-tools-libs-devel	almalinux 8	4.18.0-372.32.1.el8_6
perf	almalinux 8	4.18.0-372.32.1.el8_6
python3-perf	almalinux 8	4.18.0-372.32.1.el8_6

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2022-2588	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-aft...	7.8	0.0587	None reported
High	CVE-2022-29901	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-aft...	7.8	0.0501	None reported
High	CVE-2022-29900	AMD: CVE-2022-29900 AMD CPU Branch Type Confusion	7.8	0.0394	Exploitation Less Likely
High	CVE-2022-23825	AMD: CVE-2022-23825 AMD CPU Branch Type Confusion	7.8	0.0079	Exploitation Less Likely
High	CVE-2022-0494	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-aft...	7.8	0.0042	None reported
High	CVE-2022-1353	kernel-tools-libs-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path...	7.8	0.0040	None reported
High	CVE-2022-23816	kernel-tools-libs-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-aft...	7.8	n/a	None reported

Also fixes CVE-2022-2588

ALAS2023-2023-070
bpftool, bpftool-debuginfo, kernel and 16 more on amzn 2023
RHSA-2022:7110
bpftool, kernel, kernel-abi-stablelists and 20 more on RHEL 8
RHSA-2022:7134
kernel-rt, kernel-rt-core, kernel-rt-debug and 9 more on RHEL 8
ELSA-2022-7110
bpftool, kernel, kernel-abi-stablelists and 17 more on ol 8
RLSA-2022:7134
kernel-rt on rocky 8
RLSA-2022:7110
kernel on rocky 8
ALSA-2022:7134
kernel-rt, kernel-rt-core, kernel-rt-debug and 9 more on almalinux 8
DEBIAN-CVE-2022-2588
linux on Debian 12.15 (bookworm), Debian 13.5 (trixie), Debian 14

Vendor advisory

https://osv.dev/vulnerability/ALSA-2022:7110

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo