Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
net: psample: fix info leak in PSAMPLE_ATTR_DATA
psample open codes nla_put() presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr is padded to 4B and data_len may not be divisible by 4B.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Debian 11 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
- Affected packages:
- kernel @ 5.14.0 (+10 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Amazon Linux 2023 | Planned | — |
| Debian 11 | In Rollout |
44 kernels
|
| Debian 11 cloud | Released |
24 kernels
|
| Debian 12 | Released |
42 kernels
|
| Debian 13 | Released |
13 kernels
|
| Oracle Linux 9 UEK 7 | Planned | — |