CVE-2023-52522 Affecting kernel-debug-uki-virt package, versions <0:5.14.0-427.13.1.el9_4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE9-KERNELDEBUGUKIVIRT-6814173
- published 8 May 2024
- disclosed 2 Mar 2024
Introduced: 2 Mar 2024
CVE-2023-52522 Open this link in a new tabHow to fix?
Upgrade Oracle:9 kernel-debug-uki-virt to version 0:5.14.0-427.13.1.el9_4 or higher.
This issue was patched in ELSA-2024-2394.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-debug-uki-virt package and not the kernel-debug-uki-virt package as distributed by Oracle.
See How to fix? for Oracle:9 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
net: fix possible store tearing in neigh_periodic_work()
While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list.
Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing.
I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev().
References
- https://linux.oracle.com/cve/CVE-2023-52522.html
- https://linux.oracle.com/errata/ELSA-2024-2394.html
- https://git.kernel.org/stable/c/147d89ee41434b97043c2dcb17a97dc151859baa
- https://git.kernel.org/stable/c/25563b581ba3a1f263a00e8c9a97f5e7363be6fd
- https://git.kernel.org/stable/c/2ea52a2fb8e87067e26bbab4efb8872639240eb0
- https://git.kernel.org/stable/c/95eabb075a5902f4c0834ab1fb12dc35730c05af
- https://git.kernel.org/stable/c/a75152d233370362eebedb2643592e7c883cc9fc
- https://git.kernel.org/stable/c/f82aac8162871e87027692b36af335a2375d4580