Moderate: kernel:4.18.0 security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: edia: dvbdev: fix a use-after-free (CVE-2024-27043) * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: edia: dvbdev: fix a use-after-free (CVE-2024-27043) * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
05 / REFERENCES
Further evidence
- https://access.redhat.com/errata/RHSA-2024:10281
- https://access.redhat.com/security/cve/CVE-2024-27043
- https://access.redhat.com/security/cve/CVE-2024-27399
- https://access.redhat.com/security/cve/CVE-2024-38564
- https://access.redhat.com/security/cve/CVE-2024-46858
- https://bugzilla.redhat.com/2278445
- https://bugzilla.redhat.com/2280462
- https://bugzilla.redhat.com/2293429
- https://bugzilla.redhat.com/2315210
- https://errata.almalinux.org/8/ALSA-2024-10281.html