Linux · Security advisory · April 11, 2022

ELSA-2022-9274: Security update for 2 packages

ELSA-2022-9274, released April 11, 2022, fixes 7 CVEs across 2 products. One of them is being exploited (CVE-2021-22600); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV

CVEs closed

None rated Critical

Exploited

CVE-2021-22600

Exploitation more likely

Vendor assessment

Highest EPSS

0.0659

93rd percentile

Priority of the 7 CVEs

Patch now 1
                                Urgent 0
                                High 5
                                Routine 1

Fixed package versions

Product	Release	Fixed in
kernel-uek-container	ol 8	0:5.4.17-2136.306.1.3.el8
kernel-uek-container-debug	ol 8	0:5.4.17-2136.306.1.3.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2021-22600	linux: A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted sys...	7.8	0.0659	KEVExploited
High	CVE-2022-22942	kernel-doc: The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have be...	8.8	0.0256	None reported
High	CVE-2020-36516	kernel-modules-extra: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path...	7.8	0.0067	None reported
High	CVE-2022-0617	kernel-rt: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...	7.8	0.0050	None reported
High	CVE-2022-1016	kernel-rt-debug-modules-extra: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...	7.8	0.0044	None reported
High	CVE-2022-24448	kernel-rt: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high...	7.8	0.0040	None reported
Routine	CVE-2022-26966	linux: An issue was discovered in the Linux kernel before 5.16.12	5.5	0.0035	None reported