chore(deps): rpm updates #2252

red-hat-konflux · 2025-07-15T06:33:40Z

This PR contains the following updates:

Package	Update	Change
audit-libs	patch	`3.1.2-1.el8` -> `3.1.2-1.el8_10.1`
device-mapper	patch	`8:1.02.181-15.el8_10` -> `8:1.02.181-15.el8_10.2`
device-mapper-libs	patch	`8:1.02.181-15.el8_10` -> `8:1.02.181-15.el8_10.2`
dracut	minor	`049-233.git20240115.el8` -> `049-237.git20250603.el8_10`
emacs-filesystem	patch	`1:26.1-13.el8_10` -> `1:26.1-15.el8_10`
git	patch	`2.43.5-3.el8_10` -> `2.43.7-1.el8_10`
git-core	patch	`2.43.5-3.el8_10` -> `2.43.7-1.el8_10`
git-core-doc	patch	`2.43.5-3.el8_10` -> `2.43.7-1.el8_10`
glib2	patch	`2.56.4-165.el8_10` -> `2.56.4-166.el8_10`
kernel-headers	patch	`4.18.0-553.60.1.el8_10` -> `4.18.0-553.63.1.el8_10`
lz4-libs	patch	`1.8.3-3.el8_4` -> `1.8.3-5.el8_10`
perl-Git	patch	`2.43.5-3.el8_10` -> `2.43.7-1.el8_10`
platform-python-setuptools	patch	`39.2.0-8.el8_10` -> `39.2.0-9.el8_10`
python3-audit	patch	`3.1.2-1.el8` -> `3.1.2-1.el8_10.1`
python3-setuptools-wheel	patch	`39.2.0-8.el8_10` -> `39.2.0-9.el8_10`

git: Git arbitrary code execution

CVE-2025-48384

More information

Details

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return (CR) are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read, resulting in the submodule being checked out to an incorrect location.

Severity

Important

References

gitk: Git file creation flaw

CVE-2025-27613

More information

Details

A vulnerability has been identified in the gitk application that could lead to unauthorized file modification or data loss.

This flaw manifests in two primary scenarios:

Untrusted Repository Cloning: When a user is tricked into cloning an untrusted Git repository and then uses gitk to visualize it without any additional parameters, any writable file on the user's system can be arbitrarily created or truncated. Exploitation via this method also requires the Support per-file encoding option to be explicitly enabled in Gitk's preferences, which is not the default setting.
'Show origin of this line' Command: The vulnerability can also be triggered if a user employs the Show origin of this line command within gitk's main window while viewing a malicious repository. This method does not depend on the Support per-file encoding option being enabled.

The primary risk is unauthorized file system modification, which could lead to data integrity issues, data loss, or potentially open avenues for further system compromise.

Severity

Important

References

git: Git arbitrary file writes

CVE-2025-48385

More information

Details

A bundled uri handling flaw was found in Git. When cloning a repository, Git knows to optionally fetch a bundle advertised by the remote server, which allows the server side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection.

Severity

Important

References

git: Git GUI can create and overwrite files for which the user has write permission

CVE-2025-46835

More information

Details

A vulnerability was found in the git GUI package. When a user clones an untrusted repository and edits a file located in a maliciously named directory, git GUI may end up creating or overwriting arbitrary files for the running user has written permission. This flaw allows an attacker to modify the content of target files without the affected user's intent, resulting in a data integrity issue.

Severity

Important

References

git: Git does not sanitize URLs when asking for credentials interactively

CVE-2024-50349

More information

Details

A flaw was found in Git. This vulnerability occurs when Git requests credentials via a terminal prompt, for example, without the use of a credential helper. During this process, Git displays the host name for which the credentials are needed, but any URL-encoded parts are decoded and displayed directly. This can allow an attacker to manipulate URLs by including ANSI escape sequences, which can be interpreted by the terminal to mislead users by tricking them into entering passwords that are redirected to malicious attacker-controlled sites.

Severity

Important

References

git: Newline confusion in credential helpers can lead to credential exfiltration in git

CVE-2024-52006

More information

Details

A flaw was found in Git. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems, most notably .NET and node.js, interpret single Carriage Return characters as newlines, which render the protections against CVE-2020-5260 incomplete for credential helpers, which has the potential to expose stored credentials to malicious URLs.

Severity

Important

References

gitk: git script execution flaw

CVE-2025-27614

More information

Details

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.

Severity

Important

References

git: The sideband payload is passed unfiltered to the terminal in git

CVE-2024-52005

More information

Details

A flaw was found in Git. When cloning, fetching, or pushing from a server, informational or error messages are transported from the remote Git process to the client via a sideband channel. These messages are prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information or to mislead the user into executing untrusted scripts.

Severity

Moderate

References

glib: buffer overflow in set_connect_msg()

CVE-2024-52533

More information

Details

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4_CONN_MSG_LEN. This issue may lead to an application crash or other undefined behavior.

Severity

Moderate

References

glib2: Signal subscription vulnerabilities

CVE-2024-34397

More information

Details

A flaw was found in GNOME GLib. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This issue could lead to the GDBus-based client behaving incorrectly with an application-dependent impact.

Severity

Moderate

References

glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar

CVE-2025-4373

More information

Details

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

Severity

Moderate

References

kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

CVE-2022-49788

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

struct vmci_event_qp allocated by qp_notify_peer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:

BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121
instrument_copy_to_user ./include/linux/instrumented.h:121
_copy_to_user+0x5f/0xb0 lib/usercopy.c:33
copy_to_user ./include/linux/uaccess.h:169
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431
vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925
vfs_ioctl fs/ioctl.c:51
...

Uninit was stored to memory at:
kmemdup+0x74/0xb0 mm/util.c:131
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271
vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339
qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479
qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940
vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488
vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927
...

Local variable ev created at:
qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456
qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750

Bytes 28-31 of 48 are uninitialized
Memory access of size 48 starts at ffff888035155e00
Data copied to user address 0000000020000100

Use memset() to prevent the infoleaks.

Also speculatively fix qp_notify_peer_local(), which may suffer from the
same problem.

Severity

Moderate

References

kernel: media: uvcvideo: Remove dangling pointers

CVE-2024-58002

More information

Details

A dangling pointer vulnerability was found in the Linux kernel. When an async control is written, a copy of a pointer is made in the file handle that started the operation. If the user closes that file descriptor, its structure will be freed and there will be one dangling pointer per pending async control that the driver will try to use, leading to denial of service of the system.

Severity

Moderate

References

kernel: media: uvcvideo: Fix double free in error path

CVE-2024-57980

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix double free in error path

If the uvc_status_init() function fails to allocate the int_urb, it will
free the dev->status pointer but doesn't reset the pointer to NULL. This
results in the kfree() call in uvc_status_cleanup() trying to
double-free the memory. Fix it by resetting the dev->status pointer to
NULL after freeing it.

Reviewed by: Ricardo Ribalda [email protected]

Severity

Moderate

References

kernel: ext4: fix off-by-one error in do_split

CVE-2025-23150

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was
caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109
Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:

__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
__asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109
add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154
make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351
ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455
ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796
ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431
vfs_symlink+0x137/0x2e0 fs/namei.c:4615
do_symlinkat+0x222/0x3a0 fs/namei.c:4641
__do_sys_symlink fs/namei.c:4662 [inline]
__se_sys_symlink fs/namei.c:4660 [inline]
__x64_sys_symlink+0x7a/0x90 fs/namei.c:4660
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) {
/* is more than half of this entry in 2nd half of the block? */
if (size + map[i].size/2 > blocksize/2)
break;
size += map[i].size;
move++;
}

'i' in this case could go down to -1, in which case sum of active entries
wouldn't exceed half the block size, but previous behaviour would also do
split in half if sum would exceed at the very last block, which in case of
having too many long name files in a single block could lead to
out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Severity

Moderate

References

kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

CVE-2025-21991

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their
CPU masks and unconditionally accesses per-CPU data for the first CPU of each
mask.

According to Documentation/admin-guide/mm/numaperf.rst:

"Some memory may share the same node as a CPU, and others are provided as
memory only nodes."

Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".

On a machine with far memory (and therefore CPU-less NUMA nodes):

cpumask_of_node(nid) is 0
cpumask_first(0) is CONFIG_NR_CPUS
cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an
index that is 1 out of bounds

This does not have any security implications since flashing microcode is
a privileged operation but I believe this has reliability implications by
potentially corrupting memory while flashing a microcode update.

When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes
a microcode update. I get the following splat:

UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y
index 512 is out of range for type 'unsigned long[512]'
[...]
Call Trace:
dump_stack
__ubsan_handle_out_of_bounds
load_microcode_amd
request_microcode_amd
reload_store
kernfs_fop_write_iter
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe

Change the loop to go over only NUMA nodes which have CPUs before determining
whether the first CPU on the respective node needs microcode update.

[ bp: Massage commit message, fix typo. ]

Severity

Moderate

References

kernel: net: atm: fix use after free in lec_send()

CVE-2025-22004

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix use after free in lec_send()

The ->send() operation frees skb so save the length before calling
->send() to avoid a use after free.

Severity

Moderate

References

kernel: ext4: ignore xattrs past end

CVE-2025-37738

More information

Details

A use-after-free vulnerability has been discovered in the Linux kernel, specifically within the ext4_xattr_inode_dec_ref_all function (related to the ext4 filesystem's extended attributes). An attacker could exploit this flaw by providing a specially crafted payload, leading to a denial of service condition that compromises system availability.

Severity

Moderate

References

kernel: cifs: potential buffer overflow in handling symlinks

CVE-2022-49058

More information

Details

A buffer overflow vulnerability has been identified in the Linux kernel's Common Internet File System (CIFS) module, specifically within the parse_mf_symlink() function. This flaw is caused by insufficient input validation on the link_len value, which dictates the length of a symbolic link. An attacker could exploit this issue by providing an overly large symlink string, leading to a buffer overflow. This can result in memory corruption, system instability, or a denial-of-service condition.

Severity

Moderate

References

kernel: net: ch9200: fix uninitialised access during mii_nway_restart

CVE-2025-38086

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

net: ch9200: fix uninitialised access during mii_nway_restart

In mii_nway_restart() the code attempts to call
mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read()
utilises a local buffer called "buff", which is initialised
with control_read(). However "buff" is conditionally
initialised inside control_read():

    if (err == size) {
            memcpy(data, buf, size);
    }

If the condition of "err == size" is not met, then
"buff" remains uninitialised. Once this happens the
uninitialised "buff" is accessed and returned during
ch9200_mdio_read():

    return (buff[0] | buff[1] << 8);

The problem stems from the fact that ch9200_mdio_read()
ignores the return value of control_read(), leading to
uinit-access of "buff".

To fix this we should check the return value of
control_read() and return early on error.

Severity

Moderate

References

kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

CVE-2024-50154

More information

Details

A use-after-free (UAF) vulnerability was found and fixed in the Linux kernel's TCP subsystem related to request socket (reqsk) timers during handshake handling. This issue stems from a race condition caused by relying on timer_pending() in reqsk_queue_unlink(). This could result in the timer continuing to run after the socket (req->sk) is freed, allowing BPF programs to access invalid memory.

Severity

Moderate

References

kernel: cifs: fix potential double free during failed mount

CVE-2022-49541

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix potential double free during failed mount

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799

Severity

Important

References

kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources

CVE-2024-53150

More information

Details

A vulnerability was found in the Linux kernel's USB Audio driver. This flaw can allow an attacker with physical access to the system to use a malicious USB device to gain additional access. This is possible by reading arbitrary system memory.

Severity

Important

References

kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

CVE-2025-21927

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

nvme_tcp_recv_pdu() doesn't check the validity of the header length.
When header digests are enabled, a target might send a packet with an
invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()
to access memory outside the allocated area and cause memory corruptions
by overwriting it with the calculated digest.

Fix this by rejecting packets with an unexpected header length.

Severity

Important

References

kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt

CVE-2024-53141

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: add missing range check in bitmap_ip_uadt

When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,
the values of ip and ip_to are slightly swapped. Therefore, the range check
for ip should be done later, but this part is missing and it seems that the
vulnerability occurs.

So we should add missing range checks and remove unnecessary range checks.

Severity

Important

References

kernel: vsock: Keep the binding until socket destruction

CVE-2025-21756

More information

Details

A flaw was found in the Linux kernel's virtual socket protocol network driver, where an improperly timed socket unbinding could result in a use-after-free issue. This flaw allows an attacker who can create and destroy arbitrary connections on virtual connections to read or modify system memory, potentially leading to an escalation of privileges or the compromise of sensitive data.

Severity

Important

References

kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer

CVE-2022-49328

More information

Details

A vulnerability was found in the Linux kernel's mt76 wi-fi driver. A concurrency bug causes the mtxq TX queue to maintain a raw pointer to a wcid structure (mtxq->wcid) that might be freed by the time it is accessed. This issue can lead to a use-after-free scenario, leading to system instability, memory corruption, and potentially arbitrary code execution.

Severity

Moderate

References

kernel: tipc: fix use-after-free Read in tipc_named_reinit

CVE-2022-49696

More information

Details

A vulnerability was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem, allowing a use-after-free condition during the cleanup process. This issue arises when the kernel's work queue mechanism does not properly synchronize the destruction of TIPC namespaces with the completion of pending work items.

Specifically, the function responsible for canceling pending work (cancel_work_sync()) ensures that a particular work item (tipc_net_finalize_work) is completed before the namespace is destroyed. However, it does not guarantee that this work item is the last one queued, leading to the possibility of accessing freed memory if additional work is enqueued afterward.

Severity

Moderate

References

kernel: ndisc: use RCU protection in ndisc_alloc_skb()

CVE-2025-21764

More information

Details

A vulnerability was found in the Linux kernel's IPv6 Neighbor Discovery (NDISC) subsystem, which manages network neighbor information. The issue arises from improper synchronization mechanisms when allocating socket buffers (sk_buff) in the ndisc_alloc_skb() function. Specifically, the function can be called without holding the necessary Read-Copy-Update (RCU) or Routing Netlink (RTNL) locks, leading to a potential use-after-free (UAF) condition. This flaw allows an attacker with local access and low privileges to exploit the race condition, potentially causing system instability or crashes.

Severity

Moderate

References

kernel: Bluetooth: Fix use after free in hci_send_acl

CVE-2022-49111

More information

Details

A vulnerability was found in the Linux kernel's Bluetooth subsystem in the hci_disconn_phylink_complete_evt() function. Improper cleanup and reference handling can lead to a connection object, hcon, being freed and then later accessed during a subsequent function call. This issue can lead to a use-after-free scenario, leading to system instability, memory corruption, and potential code execution.

Severity

Moderate

References

kernel: dlm: fix plock invalid read

CVE-2022-49407

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

dlm: fix plock invalid read

This patch fixes an invalid read showed by KASAN. A unlock will allocate a
"struct plock_op" and a followed send_op() will append it to a global
send_list data structure. In some cases a followed dev_read() moves it
to recv_list and dev_write() will cast it to "struct plock_xop" and access
fields which are only available in those structures. At this point an
invalid read happens by accessing those fields.

To fix this issue the "callback" field is moved to "struct plock_op" to
indicate that a cast to "plock_xop" is allowed and does the additional
"plock_xop" handling if set.

Example of the KASAN output which showed the invalid read:

[ 2064.296453] ==================================================================
[ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm]
[ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484
[ 2064.308168]
[ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9
[ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[ 2064.311618] Call Trace:
[ 2064.312218] dump_stack_lvl+0x56/0x7b
[ 2064.313150] print_address_description.constprop.8+0x21/0x150
[ 2064.314578] ? dev_write+0x52b/0x5a0 [dlm]
[ 2064.315610] ? dev_write+0x52b/0x5a0 [dlm]
[ 2064.316595] kasan_report.cold.14+0x7f/0x11b
[ 2064.317674] ? dev_write+0x52b/0x5a0 [dlm]
[ 2064.318687] dev_write+0x52b/0x5a0 [dlm]
[ 2064.319629] ? dev_read+0x4a0/0x4a0 [dlm]
[ 2064.320713] ? bpf_lsm_kernfs_init_security+0x10/0x10
[ 2064.321926] vfs_write+0x17e/0x930
[ 2064.322769] ? __fget_light+0x1aa/0x220
[ 2064.323753] ksys_write+0xf1/0x1c0
[ 2064.324548] ? __ia32_sys_read+0xb0/0xb0
[ 2064.325464] do_syscall_64+0x3a/0x80
[ 2064.326387] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2064.327606] RIP: 0033:0x7f807e4ba96f
[ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48
[ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f
[ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010
[ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001
[ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80
[ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001
[ 2064.342857]
[ 2064.343226] Allocated by task 12438:
[ 2064.344057] kasan_save_stack+0x1c/0x40
[ 2064.345079] __kasan_kmalloc+0x84/0xa0
[ 2064.345933] kmem_cache_alloc_trace+0x13b/0x220
[ 2064.346953] dlm_posix_unlock+0xec/0x720 [dlm]
[ 2064.348811] do_lock_file_wait.part.32+0xca/0x1d0
[ 2064.351070] fcntl_setlk+0x281/0xbc0
[ 2064.352879] do_fcntl+0x5e4/0xfe0
[ 2064.354657] __x64_sys_fcntl+0x11f/0x170
[ 2064.356550] do_syscall_64+0x3a/0x80
[ 2064.358259] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2064.360745]
[ 2064.361511] Last potentially related work creation:
[ 2064.363957] kasan_save_stack+0x1c/0x40
[ 2064.365811] __kasan_record_aux_stack+0xaf/0xc0
[ 2064.368100] call_rcu+0x11b/0xf70
[ 2064.369785] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]
[ 2064.372404] receive_from_sock+0x290/0x770 [dlm]
[ 2064.374607] process_recv_sockets+0x32/0x40 [dlm]
[ 2064.377290] process_one_work+0x9a8/0x16e0
[ 2064.379357] worker_thread+0x87/0xbf0
[ 2064.381188] kthread+0x3ac/0x490
[ 2064.383460] ret_from_fork+0x22/0x30
[ 2064.385588]
[ 2064.386518] Second to last potentially related work creation:
[ 2064.389219] kasan_save_stack+0x1c/0x40
[ 2064.391043] __kasan_record_aux_stack+0xaf/0xc0
[ 2064.393303] call_rcu+0x11b/0xf70
[ 2064.394885] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]
[ 2064.397694] receive_from_sock+0x290/0x770
---truncated---

Severity

Moderate

References

kernel: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx

CVE-2022-49377

More information

Details

A use-after-free vulnerability was found in the blk_mq_get_sq_hctx function in the Linux kernel's block multiqueue (blk-mq) subsystem. This issue occurs when the function accesses the tagset pointer to determine the current default hardware context through mapping. If this access occurs after the tagset has been freed, typically after the queue cleanup process, it can lead to memory corruption. Such corruption may result in system crashes, information leaks, or privilege escalation, depending on how the freed memory is subsequently used.

Severity

Moderate

References

kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp()

CVE-2022-49114

More information

Details

A vulnerability was found in the Linux kernel's SCSI libfc library in the fc_exch_abts_resp() function, which can lead to a use-after-free scenario. This issue can occur because the function calls fc_exch_release(), which decrements a reference count stored in the ep object and then frees the object once the count is zero. However, the ep object is referenced again and can result in the now-freed ep pointer being accessed, resulting in system instability, memory corruption, and potential arbitrary code execution.

Severity

Moderate

References

Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c

CVE-2023-1652

More information

Details

A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.

Severity

Moderate

References

kernel: Squashfs: fix handling and sanity checking of xattr_ids count

CVE-2023-52933

More information

Details

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: fix handling and sanity checking of xattr_ids count

A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
sanity checking of the xattr_ids count in the filesystem. Both of these
flaws cause computation overflow due to incorrect typing.

In the corrupted filesystem the xattr_ids value is 4294967071, which
stored in a signed variable becomes the negative number -225.

Flaw 1 (64-bit systems only):

The signed integer xattr_ids variable causes sign extension.

This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The
variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
type of the sizeof operator is "unsigned long".

On a 64-bit system this is 64-bits in size, and causes the negative number
to be sign extended and widened to 64-bits and then become unsigned. This
produces the very large number 18446744073709548016 or 2^64 - 3600. This
number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and
divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0
(stored in len).

Flaw 2 (32-bit systems only):

On a 32-bit system the integer variable is not widened by the unsigned
long type of the sizeof operator (32-bits), and the signedness of the
variable has no effect due it always being treated as unsigned.

The above corrupted xattr_ids value of 4294967071, when multiplied
overflows and produces the number 4294963696 or 2^32 - 3400. This number
when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by
SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.

The effect of the 0 length computation:

In conjunction with the corrupted xattr_ids field, the filesystem also has
a corrupted xattr_table_start value, where it matches the end of
filesystem value of 850.

This causes the following sanity check code to fail because the
incorrectly computed len of 0 matches the incorrect size of the table
reported by the superblock (0 bytes).

len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);

/*
 * The computed size of the index table (len bytes) should exactly
 * match the table start and end points
*/
start = table_start + sizeof(*id_table);
end = msblk->bytes_used;

if (len != (end - start))
        return ERR_PTR(-EINVAL);

Changing the xattr_ids variable to be "usigned int" fixes the flaw on a
64-bit system. This relies on the fact the computation is widened by the
unsigned long type of the sizeof operator.

Casting the variable to u64 in the above macro fixes this flaw on a 32-bit
system.

It also means 64-bit systems do not implicitly rely on the type of the
sizeof operator to widen the computation.

[1] https://lore.kernel.org/lkml/[email protected]/

Severity

Important

References

kernel: net: atlantic: fix aq_vec index out of range error

CVE-2022-50066

More information

Details

A vulnerability was found in the Linux kernel's Aquantia Atlantic driver, where a lack of proper bounds checking during loop indexing can lead to an out-of-bounds access. This can lead to undefined system behavior and a denial of service.

Severity

Important

References

https://access.redhat.com/security/cve/CVE-2022-50066
https://bugzilla.redhat.com/show_bug.cgi?id=2373683
https://www.cve.org/CVERecord?id=CVE-2022-50066
https://nvd.nist.gov/vuln/detail/CVE-2022-50066
[https://lore.kernel.org/linux-cve-announce/2025061851-CVE-2022-50066-a2ad@gregkh/T](https://lore.ker

rhacs-bot

Auto-approved by automation.

rhacs-bot

Auto-approved by automation.

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux bot added auto-approve build-builder-image rebuild-test-container Rebuild the collector-tests container. labels Jul 15, 2025

red-hat-konflux bot requested review from rhacs-bot and a team as code owners July 15, 2025 06:33

red-hat-konflux bot added build-builder-image rebuild-test-container Rebuild the collector-tests container. auto-approve labels Jul 15, 2025

red-hat-konflux bot enabled auto-merge (squash) July 15, 2025 06:33

rhacs-bot approved these changes Jul 15, 2025

View reviewed changes

red-hat-konflux bot force-pushed the konflux/mintmaker/release-3.20/rpm-updates branch 5 times, most recently from 0f78ceb to 10ad93f Compare July 23, 2025 05:35

chore(deps): rpm updates

fe1636c

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux bot force-pushed the konflux/mintmaker/release-3.20/rpm-updates branch from 10ad93f to fe1636c Compare July 24, 2025 05:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): rpm updates #2252

chore(deps): rpm updates #2252

red-hat-konflux bot commented Jul 15, 2025 •

edited

Loading

Uh oh!

rhacs-bot left a comment

Uh oh!

rhacs-bot left a comment

Uh oh!

Uh oh!

chore(deps): rpm updates #2252

Are you sure you want to change the base?

chore(deps): rpm updates #2252

Conversation

red-hat-konflux bot commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

git: Git arbitrary code execution

Details

Severity

References

gitk: Git file creation flaw

Details

Severity

References

git: Git arbitrary file writes

Details

Severity

References

git: Git GUI can create and overwrite files for which the user has write permission

Details

Severity

References

git: Git does not sanitize URLs when asking for credentials interactively

Details

Severity

References

git: Newline confusion in credential helpers can lead to credential exfiltration in git

Details

Severity

References

gitk: git script execution flaw

Details

Severity

References

git: The sideband payload is passed unfiltered to the terminal in git

Details

Severity

References

glib: buffer overflow in set_connect_msg()

Details

Severity

References

glib2: Signal subscription vulnerabilities

Details

Severity

References

glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar

Details

Severity

References

kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

Details

Severity

References

kernel: media: uvcvideo: Remove dangling pointers

Details

Severity

References

kernel: media: uvcvideo: Fix double free in error path

Details

Severity

References

kernel: ext4: fix off-by-one error in do_split

Details

Severity

References

kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

Details

Severity

References

kernel: net: atm: fix use after free in lec_send()

Details

Severity

References

kernel: ext4: ignore xattrs past end

Details

Severity

References

kernel: cifs: potential buffer overflow in handling symlinks

Details

red-hat-konflux bot commented Jul 15, 2025 •

edited

Loading

kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().