SB2022102576 - Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions update for kpatch-patch 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022102576

SB2022102576 - Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions update for kpatch-patch

Published: October 25, 2022 Updated: March 20, 2024

Security Bulletin ID SB2022102576
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2021-3715)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem (route4_change() function in net/sched/cls_route.c) in the way it handled changing of classification filters. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.



2) Double Free (CVE-ID: CVE-2022-2588)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a double free error within the network packet scheduler implementation in the route4_change() function in Linux kernel when removing all references to a route filter before freeing it. A local user can run a specially crafted program to crash the kernel or execute arbitrary code.


Remediation

Install update from vendor's website.

References