Linux · Security advisory · March 23, 2022

ELSA-2022-9244: Security update for 9 packages

ELSA-2022-9244, released March 23, 2022, fixes 5 CVEs across 9 products. One of them is being exploited (CVE-2022-0492); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
5
None rated Critical
Exploited
1
CVE-2022-0492
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.6777
99th percentile

Priority of the 5 CVEs

Patch now 1 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
kernel-uekol 80:5.4.17-2136.305.5.3.el8uek
kernel-uek-debugol 80:5.4.17-2136.305.5.3.el8uek
kernel-uek-debug-develol 80:5.4.17-2136.305.5.3.el8uek
kernel-uek-develol 80:5.4.17-2136.305.5.3.el8uek
kernel-uek-docol 80:5.4.17-2136.305.5.3.el8uek
kernel-uek-toolsol 80:5.4.17-2136.305.5.3.el7uek
kernel-uek-tools-libsol 80:5.4.17-2136.305.5.3.el7uek
perfol 80:5.4.17-2136.305.5.3.el7uek
python-perfol 80:5.4.17-2136.305.5.3.el7uek

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2022-0492 kernel-tools-libs-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have be... 8.8 0.0553 KEVExploited
High CVE-2022-0435 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have be... 8.8 0.6777 None reported
High CVE-2022-25636 kernel-rt-core: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high... 7.8 0.0263 None reported
High CVE-2021-39685 linux: In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect fla... 7.8 0.0046 None reported
High CVE-2022-0330 kernel-tools-libs-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have be... 8.8 0.0038 None reported
Showing 1 to 5 of 5 1