ID

VAR-202206-1186

CVE

CVE-2022-21125

TITLE

Red Hat Security Advisory 2022-6991-01

DESCRIPTION

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21499) It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Bug Fix(es): * The latest RHEL 8.6.z3 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2111112) 4. CVE-2022-21123, CVE-2022-21125, CVE-2022-21127, CVE-2022-21166 Various researchers discovered flaws in Intel processors, collectively referred to as MMIO Stale Data vulnerabilities, which may result in information leak to local users. For the oldstable distribution (buster), these problems have been fixed in version 3.20220510.1~deb10u1. For the stable distribution (bullseye), these problems have been fixed in version 3.20220510.1~deb11u1. We recommend that you upgrade your intel-microcode packages. For the detailed security status of intel-microcode please refer to its security tracker page at: https://security-tracker.debian.org/tracker/intel-microcode Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmLFiNRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QsfQ/7BFnYhmBMr5u1iyXJY79QkOuBFij/I7N5doGb/5m/LTbUOKgHKlI3XKqr NHbWZWQZVO7gexkZIdGSY2RnCtVS1oNkKxNzuFVxkPjbsRpJJBAyPqoY6JogDjhM 18jXAyZqB5tfZdGohiHBeVDsQwP5M3IPTdG2USoLOwcwd5+BK8ZgdrLrREDHo9mA +VJU8fhGRpdminz5MR2NPenu5jgG2JVKAhFRC8ioy92umF/5c/C6wRAyQsRid4lZ i+lzWAOQbUzvUGlomDrjqtSEn0fVQR2A0VoU+5AQnln8fODQmSLOHo/Ti00RuUUL 8WLfrKnfimXvTWnUeWKLCnHIRCbzLBfPa1EPbCagkD7XDkcYd+MWLm0C6RhUvBPN p3U9AbWstO4z2RjldX1DYUVeCR5zQqBT6pAY6G14MqIvuqrAodi9p0jgjOchdCUZ Hv4H6b0F7QusCZrj1onfe4//CG5AmN0D8E/QKCKNBplJmciVg2o/8R0hTfaKDK8v NhUYBkEWnG0zUlo93Qkapqc00j5i7cbXKbzRV3zPa42WtypoS8yd/tftZ6y7yBpa lHZOAVcfdDcN7jm9U9ZV3tVCCs3Cu5wb3ZYoYyhfEZBpEgCQ7YEEPQffTq9Y3LMN 4IUiKp8LINReMEEfV8My7PB2fX8dvti2lEQ/pJfAC/XKNoassd0= =8N2y -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: kernel security and bug fix update Advisory ID: RHSA-2022:5937-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:5937 Issue date: 2022-08-09 CVE Names: CVE-2022-21123 CVE-2022-21125 CVE-2022-21166 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * Incomplete cleanup of multi-core shared buffers (aka SBDR) (CVE-2022-21123) * Incomplete cleanup of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125) * Incomplete cleanup in specific special register write operations (aka DRPW) (CVE-2022-21166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * SolarFlare sfc spurious TX completion (BZ#1793280) * Page allocation failure on cryptsetup open (BZ#2072970) * The kernel-rt crashes where one task is indefinitely looping in __start_cfs_bandwidth() with the cfs_b->lock spinlock being held (BZ#2077346) * While using PTimekeeper the qede driver produces excessive log messages (BZ#2080646) * The kernel crashes due to a GPF happens in mutex_spin_on_owner(). The known RDMA/cma bug that was introduced with a patch from upstream commit 722c7b2bfead is the possible cause. (BZ#2085425) * Running LTP testcase creat09 fails showing related to 'cve-2018-13405' (BZ#2089360) * Crash when releasing inode which was on unmouted superblock (BZ#2096884) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2090237 - CVE-2022-21123 hw: cpu: Incomplete cleanup of multi-core shared buffers (aka SBDR) 2090240 - CVE-2022-21125 hw: cpu: Incomplete cleanup of microarchitectural fill buffers (aka SBDS) 2090241 - CVE-2022-21166 hw: cpu: Incomplete cleanup in specific special register write operations (aka DRPW) 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: kernel-3.10.0-1160.76.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.76.1.el7.noarch.rpm kernel-doc-3.10.0-1160.76.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.76.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.76.1.el7.x86_64.rpm perf-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: kernel-3.10.0-1160.76.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.76.1.el7.noarch.rpm kernel-doc-3.10.0-1160.76.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.76.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.76.1.el7.x86_64.rpm perf-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: kernel-3.10.0-1160.76.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.76.1.el7.noarch.rpm kernel-doc-3.10.0-1160.76.1.el7.noarch.rpm ppc64: bpftool-3.10.0-1160.76.1.el7.ppc64.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-3.10.0-1160.76.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debug-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-1160.76.1.el7.ppc64.rpm kernel-devel-3.10.0-1160.76.1.el7.ppc64.rpm kernel-headers-3.10.0-1160.76.1.el7.ppc64.rpm kernel-tools-3.10.0-1160.76.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-1160.76.1.el7.ppc64.rpm perf-3.10.0-1160.76.1.el7.ppc64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm python-perf-3.10.0-1160.76.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm ppc64le: bpftool-3.10.0-1160.76.1.el7.ppc64le.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debug-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-devel-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-headers-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-tools-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-1160.76.1.el7.ppc64le.rpm perf-3.10.0-1160.76.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm python-perf-3.10.0-1160.76.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm s390x: bpftool-3.10.0-1160.76.1.el7.s390x.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.s390x.rpm kernel-3.10.0-1160.76.1.el7.s390x.rpm kernel-debug-3.10.0-1160.76.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.s390x.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.s390x.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-1160.76.1.el7.s390x.rpm kernel-devel-3.10.0-1160.76.1.el7.s390x.rpm kernel-headers-3.10.0-1160.76.1.el7.s390x.rpm kernel-kdump-3.10.0-1160.76.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-1160.76.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-1160.76.1.el7.s390x.rpm perf-3.10.0-1160.76.1.el7.s390x.rpm perf-debuginfo-3.10.0-1160.76.1.el7.s390x.rpm python-perf-3.10.0-1160.76.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.s390x.rpm x86_64: bpftool-3.10.0-1160.76.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.76.1.el7.x86_64.rpm perf-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: bpftool-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-1160.76.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-1160.76.1.el7.ppc64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.ppc64.rpm ppc64le: bpftool-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-1160.76.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.ppc64le.rpm x86_64: bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: kernel-3.10.0-1160.76.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.76.1.el7.noarch.rpm kernel-doc-3.10.0-1160.76.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.76.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.76.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.76.1.el7.x86_64.rpm perf-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.76.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.76.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-21123 https://access.redhat.com/security/cve/CVE-2022-21125 https://access.redhat.com/security/cve/CVE-2022-21166 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYvKiCNzjgjWX9erEAQgz2A/+O9gKIbQCWne03iCkr+RZwdgghaS4zC6Z 8/iPJhQf3ZKdVQ1/otcA4SK+AwazrjOJx5Dnn5kTY+5Vc/xJQ0/lX5wmWggzZxgz tX+f/BDwU47c7Ie1oXHgIalaVZ3jzIXS9fWuKcry9uLP9QoXPuWSj+eP1Cm3wiLW +xY5AKIIhFHE7UYc2U3hNfBVy15dcGiTeVHr/Mmk9/fTFu88RgSuZPWiUi+MJAo+ U2UfnpCkom7isYR86HP44uGc2BZf2pRqi4b/iICVHA/dV93FZ1ldlS6fZIIXTYxV 8RtRakX9yrB4OLtpIFYpWQth04H+h5gMAiam7MZws8VtjYgWYcwU8kPhS+hf0W4I uEd1fRU0F7QYrgjrxioPMW7ImPuklDtUELq3laXHyy+wDs3deZQ9csGWCqaPyTkK /jnnWMAQzB6ZYX4bmXwFtkAEmA7Dx3S4DP6SMW0yt7y+xmg2WGP8SHp3nxBlqbbv nOpY35/HWQpKsYU91Z0i/DN/BmDnmsMOqEU6bAYnGZezbwUnl+OlKF2DoAaQLvBQ aVfHcXhKLL1nRI8HNt98YxJHaf4dtTJCSCWnO/xdaZcDkCWMCReB2PGxzL5MEbTc 7pOvB7yANf+aztsAee3dOCZTMnDDh10mgb+NelQgR5nQRxYpw7YY3JCwy/bSO3Na btaLByp4p3I=VyEw -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-5535-1 July 28, 2022 Intel Microcode vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM Summary: Several security issues were fixed in Intel Microcode. Software Description: - intel-microcode: Processor microcode for Intel CPUs Details: Joseph Nuzman discovered that some Intel processors did not properly initialise shared resources. A local attacker could use this to obtain sensitive information. (CVE-2021-0145) Mark Ermolov, Dmitry Sklyarov and Maxim Goryachy discovered that some Intel processors did not prevent test and debug logic from being activated at runtime. A local attacker could use this to escalate privileges. (CVE-2021-0146) It was discovered that some Intel processors did not implement sufficient control flow management. A local attacker could use this to cause a denial of service (system crash). (CVE-2021-0127) It was discovered that some Intel processors did not completely perform cleanup actions on multi-core shared buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21123, CVE-2022-21127) It was discovered that some Intel processors did not completely perform cleanup actions on microarchitectural fill buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21125) Alysa Milburn, Jason Brandt, Avishai Redelman and Nir Lavi discovered that some Intel processors improperly optimised security-critical code. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21151) It was discovered that some Intel processors did not properly perform cleanup during specific special register write operations. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21166) It was discovered that some Intel processors did not properly restrict access in some situations. A local attacker could use this to obtain sensitive information. (CVE-2021-33117) Brandon Miller discovered that some Intel processors did not properly restrict access in some situations. A local attacker could use this to obtain sensitive information or a remote attacker could use this to cause a denial of service (system crash). (CVE-2021-33120) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: intel-microcode 3.20220510.0ubuntu0.16.04.1+esm1 In general, a standard system update will make all the necessary changes. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Bug Fix(es): * Bad page state in process qemu-kvm pfn:68a74600 (BZ#2081013) * slub corruption during LPM of hnv interface (BZ#2081250) * Affinity broken due to vector space exhaustion (BZ#2084646) * 'rmmod pmt_telemetry' panics on ADL-P IOTG (BZ#2091079) * Unable to boot RHEL-8.6 on Brazos max. config (Install is success) (BZ#2092241) * kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095654) * mt7921: free resources on pci_probe error path (BZ#2101684) * NLM should be more defensive if underlying FS changes fl_owner (BZ#2102099) * RHEL8/async-pf Guest call trace when reboot after postcopy migration with high stress workload (BZ#2105340) * execve exit tracepoint not called (BZ#2106662) * QProcess dead lock on kernel-4.18.0-358 (BZ#2107643) * KVM fix guest FPU uABI size to kvm_xsave (BZ#2107652) * KVM selftests fail to compile (BZ#2107655) * Some monitor have no display with AMD W6400 when boot into OS. (BZ#2109826) * Percpu counter usage is gradually getting increasing during podman container recreation. (BZ#2110039) * multipath failed to recover after EEH hit on flavafish adapter on Denali(qla2xxx/flavafish/RHEL8.6/Denali) (BZ#2110768) * soft lockups under heavy I/O load to ahci connected SSDs (BZ#2110772) * trouble re-assigning MACs to VFs, ice stricter than other drivers (BZ#2111936) * Intel MPI 2019.0 - mpirun stuck on latest kernel (BZ#2112030) * Multicast packets are not received by all VFs on the same port even though they have the same VLAN (BZ#2117026) * Hyper-V 2019 Dynamic Memory Problem hv_balloon (BZ#2117050) * kernel BUG at kernel/sched/deadline.c:1561! (BZ#2117410) * ALSA (sound) driver - update Intel SOF kcontrol code (BZ#2117732) * bridge over bond over ice ports has no connection (BZ#2118580) * Fix max VLANs available for VF (BZ#2118581) * offline selftest failed (BZ#2118582) * INTEL NVMUpdate utility ver 3.20 is failing to update firmware on E810-XXVDA4T (WPC) (BZ#2118583) * VM configured with failover interface will coredump after been migrating from source host to target host(only iavf driver) (BZ#2118705) * Fix max VLANs available for untrusted VF (BZ#2118707) * Softlockup on infinite loop in task_get_css() for a CSS_DYING cpuset (BZ#2120776) Enhancement(s): * KVM Sapphire Rapids (SPR) AMX Instructions (BZ#2088287) * KVM Sapphire Rapids (SPR) AMX Instructions part2 (BZ#2088288) * ice: Driver Update (BZ#2102359) * iavf: Driver Update (BZ#2102360) * iommu/vt-d: Make DMAR_UNITS_SUPPORTED a config setting (BZ#2112983) 4. Description: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.9.7 images. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 2094982 - CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key 2130218 - 4.9.7 containers 5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

arbitrary

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-02-07T22:47:57.978000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE