Linux · Security advisory · August 8, 2023

ALSA-2023:4517: Security update for 24 packages

ALSA-2023:4517, released August 8, 2023, fixes 6 CVEs across 24 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0246

84th percentile

Priority of the 6 CVEs

Patch now 0
                                Urgent 0
                                High 6
                                Routine 0

Fixed package versions

Product	Release	Fixed in
bpftool	almalinux 8	4.18.0-477.21.1.el8_8
kernel	almalinux 8	4.18.0-477.21.1.el8_8
kernel-abi-stablelists	almalinux 8	4.18.0-477.21.1.el8_8
kernel-core	almalinux 8	4.18.0-477.21.1.el8_8
kernel-cross-headers	almalinux 8	4.18.0-477.21.1.el8_8
kernel-debug	almalinux 8	4.18.0-477.21.1.el8_8
kernel-debug-core	almalinux 8	4.18.0-477.21.1.el8_8
kernel-debug-devel	almalinux 8	4.18.0-477.21.1.el8_8
kernel-debug-modules	almalinux 8	4.18.0-477.21.1.el8_8
kernel-debug-modules-extra	almalinux 8	4.18.0-477.21.1.el8_8
kernel-devel	almalinux 8	4.18.0-477.21.1.el8_8
kernel-doc	almalinux 8	4.18.0-477.21.1.el8_8
kernel-modules	almalinux 8	4.18.0-477.21.1.el8_8
kernel-modules-extra	almalinux 8	4.18.0-477.21.1.el8_8
kernel-tools	almalinux 8	4.18.0-477.21.1.el8_8
kernel-tools-libs	almalinux 8	4.18.0-477.21.1.el8_8
kernel-tools-libs-devel	almalinux 8	4.18.0-477.21.1.el8_8
kernel-zfcpdump	almalinux 8	4.18.0-477.21.1.el8_8
kernel-zfcpdump-core	almalinux 8	4.18.0-477.21.1.el8_8
kernel-zfcpdump-devel	almalinux 8	4.18.0-477.21.1.el8_8
kernel-zfcpdump-modules	almalinux 8	4.18.0-477.21.1.el8_8
kernel-zfcpdump-modules-extra	almalinux 8	4.18.0-477.21.1.el8_8
perf	almalinux 8	4.18.0-477.21.1.el8_8
python3-perf	almalinux 8	4.18.0-477.21.1.el8_8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2022-42896	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u...	8.8	0.0246	None reported
High	CVE-2023-1829	linux: A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve...	8.1	0.0106	None reported
High	CVE-2023-2124	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u...	8.1	0.0049	None reported
High	CVE-2023-1281	linux: Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The...	8.1	0.0030	None reported
High	CVE-2023-2235	linux: A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privil...	8.1	0.0025	None reported
High	CVE-2023-2194	kernel-debug-modules: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u...	8.1	0.0024	None reported

Also fixes CVE-2022-42896

RHSA-2023:2458
bpftool, kernel, kernel-64k and 43 more on RHEL 9
RHSA-2023:2148
kernel-rt, kernel-rt-core, kernel-rt-debug and 11 more on RHEL 9
ELSA-2023-2458
bpftool, kernel, kernel-abi-stablelists and 24 more on ol 9
ALSA-2023:2148
kernel-rt, kernel-rt-core, kernel-rt-debug and 11 more on almalinux 9
ALSA-2023:2458
bpftool, kernel, kernel-64k and 44 more on almalinux 9
RLSA-2023:4541
kernel-rt on rocky 8
RLSA-2023:4517
kernel on rocky 8
ELSA-2023-4517
bpftool, kernel, kernel-abi-stablelists and 17 more on ol 8

Vendor advisory

https://osv.dev/vulnerability/ALSA-2023:4517

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo