Bug 2163379 (CVE-2023-0266)
| Summary: | CVE-2023-0266 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Rohit Keshri <rkeshri> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | acaringi, arachman, bhu, chwhite, crwood, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kechoi, kernel-mgr, kpatch-maint, lgoncalv, lleshchi, lveyde, lzampier, michal.skrivanek, mperina, nmurray, ptalbert, qzhao, rhandlin, rogbas, rvrbovsk, sbonazzo, scweaver, tyberry, vkumar, vsroka, walters, williams, ycote |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Kernel 6.2 RC4 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A use-after-free flaw was found in snd_ctl_elem_read in sound/core/control.c in Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak problem.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-04-10 13:01:29 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2125540, 2163389, 2163390, 2163391, 2163392, 2163393, 2163394, 2163395, 2163396, 2163397, 2163399, 2163400, 2163401, 2163402, 2163403, 2163404, 2163405, 2163406, 2163409, 2163410, 2163411, 2163412, 2163413, 2163414, 2163415, 2175635 | ||
| Bug Blocks: | 2162737 | ||
|
Description
Rohit Keshri
2023-01-23 10:30:14 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:1202 https://access.redhat.com/errata/RHSA-2023:1202 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:1203 https://access.redhat.com/errata/RHSA-2023:1203 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:1435 https://access.redhat.com/errata/RHSA-2023:1435 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:1469 https://access.redhat.com/errata/RHSA-2023:1469 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:1471 https://access.redhat.com/errata/RHSA-2023:1471 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:1470 https://access.redhat.com/errata/RHSA-2023:1470 A customer is waiting on a fix for RHEL 8.7. Will the fix be backported to RHEL 8? Are there any mitigation steps available? This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2023:1556 https://access.redhat.com/errata/RHSA-2023:1556 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:1554 https://access.redhat.com/errata/RHSA-2023:1554 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2023:1560 https://access.redhat.com/errata/RHSA-2023:1560 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2023:1557 https://access.redhat.com/errata/RHSA-2023:1557 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2023:1559 https://access.redhat.com/errata/RHSA-2023:1559 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:1584 https://access.redhat.com/errata/RHSA-2023:1584 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2023:1588 https://access.redhat.com/errata/RHSA-2023:1588 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2023:1590 https://access.redhat.com/errata/RHSA-2023:1590 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:1566 https://access.redhat.com/errata/RHSA-2023:1566 In reply to comment #13: > A customer is waiting on a fix for RHEL 8.7. Will the fix be backported to > RHEL 8? Are there any mitigation steps available? Hello, Yes we has this fixed for RHEL 8.7, please refer to the CVE page as well for more information. Thank you. This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2023:1662 https://access.redhat.com/errata/RHSA-2023:1662 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:1660 https://access.redhat.com/errata/RHSA-2023:1660 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:1659 https://access.redhat.com/errata/RHSA-2023:1659 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Via RHSA-2023:1666 https://access.redhat.com/errata/RHSA-2023:1666 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2023:1677 https://access.redhat.com/errata/RHSA-2023:1677 Closing this bug as most of the fixes were already delivered through erratas. |