ALT-PU-2023-1627-1
Package kernel-image-centos updated to version 5.14.0.300-alt1.el9 for branch sisyphus in task 318640.
Closed vulnerabilities
BDU:2023-01273
Уязвимость функции ovl_write_iter() файловой системы overlayfs ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
BDU:2023-01572
Уязвимость функции stat() подсистемы OverlayFS ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии
Modified: 2025-02-26
CVE-2023-0386
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update
- [debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update
- [debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update
- https://security.netapp.com/advisory/ntap-20230420-0004/
- https://security.netapp.com/advisory/ntap-20230420-0004/
- DSA-5402
- DSA-5402
Modified: 2024-11-21
CVE-2023-1252
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.