Skip to main content
Skip table of contents

ISN 2024-06: OS 11 Kernel Vulnerabilities

First published 12 March 2024

CVSS 3.1: 8.4 (High)

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple security vulnerabilities have been found in the Linux Kernel version used in IGEL OS. This affects the following IGEL products:

  • IGEL OS 11

Details

The Linux Kernel version 6.1.42 used in IGEL OS 11 is affected by a use-after-free vulnerability in the NVMe/TCP subsystem in the Linux kernel. This may allow an attacker to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation (CVE-2023-5178, high).

Another security issue has been discovered in the TLS subsystem of the Linux Kernel. Under certain circumstances, a use-after-free can be triggered (CVE-2024-26582). An attacker could use this to trigger a denial of service or code execution, so the severity of this vulnerability is rated as high. CVE-2024-0646 also affects TLS and may lead to privilege escalation. Both issues are rated as high.

Improper access control has been found in the Intel Ethernet Controller RDMA driver for Linux before version 1.9.30. It may allow an unauthenticated user to potentially enable escalation of privilege via network access (CVE-2023-25775, high).

Several vulnerabilities affect the kernel’s net/sched subsystem and can allow for local privilege escalation (CVE-2023-4206, CVE-2023-4207, CVE-2023-4208, CVE-2023-4623 and CVE-2023-4921).

Netfilter/nftables-is affected by CVE-2023-6817, CVE-2024-1086, CVE-2023-4015, CVE-2023-4147, CVE-2023-42753 and CVE-2024-22705, which might enable privilege escalation.

CVE-2023-40283 and CVE-2023-51779 both describe use-after-frees in Bluetooth.

In addition to the above, the kernel is affected by the issues CVE-2023-46813, CVE-2023-5717, CVE-2023-6932, CVE-2023-6531, CVE-2023-6931, CVE-2023-51780, CVE-2023-51781 and CVE-2023-51782. They are rated as high and may lead to local privilege escalation.

Update Instructions

  • OS 11: Update to IGEL OS 11.10.100, which has a complete kernel upgrade, when it is available.

References

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close