ISHACK AI BOT

Ubuntu: (CVE-2023-28327): linux vulnerability Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 11/21/2024 Added 11/19/2024 Modified 02/11/2025 Description A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Solution(s) ubuntu-upgrade-linux ubuntu-upgrade-linux-aws ubuntu-upgrade-linux-aws-5-15 ubuntu-upgrade-linux-aws-5-4 ubuntu-upgrade-linux-aws-fips ubuntu-upgrade-linux-azure ubuntu-upgrade-linux-azure-5-15 ubuntu-upgrade-linux-azure-5-4 ubuntu-upgrade-linux-azure-fde ubuntu-upgrade-linux-azure-fde-5-15 ubuntu-upgrade-linux-azure-fips ubuntu-upgrade-linux-bluefield ubuntu-upgrade-linux-fips ubuntu-upgrade-linux-gcp ubuntu-upgrade-linux-gcp-5-15 ubuntu-upgrade-linux-gcp-5-4 ubuntu-upgrade-linux-gcp-fips ubuntu-upgrade-linux-gke ubuntu-upgrade-linux-gkeop ubuntu-upgrade-linux-gkeop-5-15 ubuntu-upgrade-linux-hwe-5-15 ubuntu-upgrade-linux-hwe-5-4 ubuntu-upgrade-linux-ibm ubuntu-upgrade-linux-ibm-5-4 ubuntu-upgrade-linux-intel-iot-realtime ubuntu-upgrade-linux-intel-iotg ubuntu-upgrade-linux-intel-iotg-5-15 ubuntu-upgrade-linux-iot ubuntu-upgrade-linux-kvm ubuntu-upgrade-linux-lowlatency ubuntu-upgrade-linux-lowlatency-hwe-5-15 ubuntu-upgrade-linux-nvidia ubuntu-upgrade-linux-oracle ubuntu-upgrade-linux-oracle-5-15 ubuntu-upgrade-linux-oracle-5-4 ubuntu-upgrade-linux-raspi ubuntu-upgrade-linux-raspi-5-4 ubuntu-upgrade-linux-realtime ubuntu-upgrade-linux-riscv-5-15 ubuntu-upgrade-linux-xilinx-zynqmp References https://attackerkb.com/topics/cve-2023-28327 CVE - 2023-28327 https://access.redhat.com/security/cve/CVE-2023-28327 https://www.cve.org/CVERecord?id=CVE-2023-28327

Ubuntu: (Multiple Advisories) (CVE-2023-27043): Python vulnerabilities Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:P/A:N) Published 04/19/2023 Created 09/18/2024 Added 09/17/2024 Modified 01/28/2025 Description The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. Solution(s) ubuntu-pro-upgrade-python2-7 ubuntu-pro-upgrade-python2-7-minimal ubuntu-pro-upgrade-python3-10 ubuntu-pro-upgrade-python3-10-minimal ubuntu-pro-upgrade-python3-12 ubuntu-pro-upgrade-python3-12-minimal ubuntu-pro-upgrade-python3-5 ubuntu-pro-upgrade-python3-5-minimal ubuntu-pro-upgrade-python3-8 ubuntu-pro-upgrade-python3-8-minimal References https://attackerkb.com/topics/cve-2023-27043 CVE - 2023-27043 USN-7015-1 USN-7015-3 USN-7015-4 USN-7015-5 USN-7015-6

Huawei EulerOS: CVE-2023-28328: kernel security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 05/10/2023 Added 05/09/2023 Modified 01/28/2025 Description A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. Solution(s) huawei-euleros-2_0_sp10-upgrade-kernel huawei-euleros-2_0_sp10-upgrade-kernel-abi-stablelists huawei-euleros-2_0_sp10-upgrade-kernel-tools huawei-euleros-2_0_sp10-upgrade-kernel-tools-libs huawei-euleros-2_0_sp10-upgrade-python3-perf References https://attackerkb.com/topics/cve-2023-28328 CVE - 2023-28328 EulerOS-SA-2023-1824

Huawei EulerOS: CVE-2023-1382: kernel security update Severity 4 CVSS (AV:L/AC:M/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 05/10/2023 Added 05/09/2023 Modified 01/28/2025 Description A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Solution(s) huawei-euleros-2_0_sp10-upgrade-kernel huawei-euleros-2_0_sp10-upgrade-kernel-abi-stablelists huawei-euleros-2_0_sp10-upgrade-kernel-tools huawei-euleros-2_0_sp10-upgrade-kernel-tools-libs huawei-euleros-2_0_sp10-upgrade-python3-perf References https://attackerkb.com/topics/cve-2023-1382 CVE - 2023-1382 EulerOS-SA-2023-1824

Debian: CVE-2023-28328: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 05/05/2023 Added 05/01/2023 Modified 01/28/2025 Description A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-28328 CVE - 2023-28328 DLA-3403-1 DLA-3404-1

Debian: CVE-2023-28327: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 07/31/2024 Added 07/30/2024 Modified 01/28/2025 Description A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-28327 CVE - 2023-28327

Debian: CVE-2023-2162: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 04/19/2023 Created 05/05/2023 Added 05/01/2023 Modified 01/28/2025 Description A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-2162 CVE - 2023-2162 DLA-3403-1 DLA-3404-1

Debian: CVE-2023-2134: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/19/2023 Created 05/05/2023 Added 04/24/2023 Modified 01/28/2025 Description Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-2134 CVE - 2023-2134 DSA-5393-1

Debian: CVE-2023-2135: chromium -- security update Severity 8 CVSS (AV:N/AC:H/Au:N/C:C/I:C/A:C) Published 04/19/2023 Created 05/05/2023 Added 04/24/2023 Modified 01/28/2025 Description Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-2135 CVE - 2023-2135 DSA-5393-1

Debian: CVE-2023-27043: Multiple Affected Packages Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:P/A:N) Published 04/19/2023 Created 12/03/2024 Added 12/02/2024 Modified 01/28/2025 Description The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. Solution(s) debian-upgrade-pypy3 debian-upgrade-python2-7 debian-upgrade-python3-11 debian-upgrade-python3-9 References https://attackerkb.com/topics/cve-2023-27043 CVE - 2023-27043 DLA-3966-1

Debian: CVE-2023-2166: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 07/31/2024 Added 07/30/2024 Modified 01/28/2025 Description A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-2166 CVE - 2023-2166

Oracle Linux: CVE-2023-3268: ELSA-2023-7077:kernel security, bug fix, and enhancement update (IMPORTANT) (Multiple Advisories) Severity 6 CVSS (AV:L/AC:L/Au:M/C:C/I:N/A:C) Published 04/19/2023 Created 11/18/2023 Added 11/16/2023 Modified 01/07/2025 Description An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. An out-of-bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw allows a local attacker to crash the system or leak kernel internal information. Solution(s) oracle-linux-upgrade-kernel References https://attackerkb.com/topics/cve-2023-3268 CVE - 2023-3268 ELSA-2023-7077 ELSA-2023-6583

Cisco Catalyst SD-WAN: CVE-2023-20098: Cisco SD-WAN vManage Software Arbitrary File Deletion Vulnerability Severity 4 CVSS (AV:L/AC:L/Au:M/C:N/I:C/A:N) Published 04/19/2023 Created 07/02/2024 Added 06/25/2024 Modified 08/29/2024 Description A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root. Solution(s) cisco-catalyst-sdwan-update-latest References https://attackerkb.com/topics/cve-2023-20098 CVE - 2023-20098 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN cisco-sa-sdwan-vmanage-wfnqmYhN

Cisco TelePresence Endpoint Software (TC/CE): CVE-2023-20093: Cisco TelePresence Collaboration Endpoint and RoomOS Arbitrary File Write Vulnerabilities Severity 4 CVSS (AV:L/AC:L/Au:M/C:N/I:C/A:N) Published 04/19/2023 Created 02/15/2025 Added 02/14/2025 Modified 02/14/2025 Description Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account. Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Solution(s) cisco-telepresence-ce-upgrade-latest References https://attackerkb.com/topics/cve-2023-20093 CVE - 2023-20093 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf cisco-sa-roomos-file-write-rHKwegKf

Cisco TelePresence Endpoint Software (TC/CE): CVE-2023-20092: Cisco TelePresence Collaboration Endpoint and RoomOS Arbitrary File Write Vulnerabilities Severity 4 CVSS (AV:L/AC:L/Au:M/C:N/I:C/A:N) Published 04/19/2023 Created 02/15/2025 Added 02/14/2025 Modified 02/14/2025 Description Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account. Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. Solution(s) cisco-telepresence-ce-upgrade-latest References https://attackerkb.com/topics/cve-2023-20092 CVE - 2023-20092 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf cisco-sa-roomos-file-write-rHKwegKf

Cisco TelePresence Endpoint Software (TC/CE): CVE-2023-20091: Cisco TelePresence Collaboration Endpoint and RoomOS Arbitrary File Write Vulnerabilities Severity 5 CVSS (AV:L/AC:L/Au:M/C:N/I:C/A:P) Published 04/19/2023 Created 02/15/2025 Added 02/14/2025 Modified 02/14/2025 Description A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. This vulnerability is due to improper access controls on files that are on the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit this vulnerability, an attacker would need to have a remote support user account. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Solution(s) cisco-telepresence-ce-upgrade-latest References https://attackerkb.com/topics/cve-2023-20091 CVE - 2023-20091 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf cisco-sa-roomos-file-write-rHKwegKf

Alma Linux: CVE-2023-27043: Moderate: python3.11 security update (Multiple Advisories) Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:P/A:N) Published 04/19/2023 Created 01/19/2024 Added 01/18/2024 Modified 02/13/2025 Description The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. Solution(s) alma-upgrade-platform-python alma-upgrade-platform-python-debug alma-upgrade-platform-python-devel alma-upgrade-python-unversioned-command alma-upgrade-python3 alma-upgrade-python3-debug alma-upgrade-python3-devel alma-upgrade-python3-idle alma-upgrade-python3-libs alma-upgrade-python3-test alma-upgrade-python3-tkinter alma-upgrade-python3.11 alma-upgrade-python3.11-debug alma-upgrade-python3.11-devel alma-upgrade-python3.11-idle alma-upgrade-python3.11-libs alma-upgrade-python3.11-rpm-macros alma-upgrade-python3.11-test alma-upgrade-python3.11-tkinter alma-upgrade-python39 alma-upgrade-python39-attrs alma-upgrade-python39-cffi alma-upgrade-python39-chardet alma-upgrade-python39-cryptography alma-upgrade-python39-cython alma-upgrade-python39-debug alma-upgrade-python39-devel alma-upgrade-python39-idle alma-upgrade-python39-idna alma-upgrade-python39-iniconfig alma-upgrade-python39-libs alma-upgrade-python39-lxml alma-upgrade-python39-mod_wsgi alma-upgrade-python39-more-itertools alma-upgrade-python39-numpy alma-upgrade-python39-numpy-doc alma-upgrade-python39-numpy-f2py alma-upgrade-python39-packaging alma-upgrade-python39-pip alma-upgrade-python39-pip-wheel alma-upgrade-python39-pluggy alma-upgrade-python39-ply alma-upgrade-python39-psutil alma-upgrade-python39-psycopg2 alma-upgrade-python39-psycopg2-doc alma-upgrade-python39-psycopg2-tests alma-upgrade-python39-py alma-upgrade-python39-pybind11 alma-upgrade-python39-pybind11-devel alma-upgrade-python39-pycparser alma-upgrade-python39-pymysql alma-upgrade-python39-pyparsing alma-upgrade-python39-pysocks alma-upgrade-python39-pytest alma-upgrade-python39-pyyaml alma-upgrade-python39-requests alma-upgrade-python39-rpm-macros alma-upgrade-python39-scipy alma-upgrade-python39-setuptools alma-upgrade-python39-setuptools-wheel alma-upgrade-python39-six alma-upgrade-python39-test alma-upgrade-python39-tkinter alma-upgrade-python39-toml alma-upgrade-python39-urllib3 alma-upgrade-python39-wcwidth alma-upgrade-python39-wheel alma-upgrade-python39-wheel-wheel References https://attackerkb.com/topics/cve-2023-27043 CVE - 2023-27043 https://errata.almalinux.org/8/ALSA-2024-0256.html https://errata.almalinux.org/8/ALSA-2024-2985.html https://errata.almalinux.org/8/ALSA-2024-3062.html https://errata.almalinux.org/9/ALSA-2024-0466.html https://errata.almalinux.org/9/ALSA-2024-2292.html

Huawei EulerOS: CVE-2022-2084: cloud-init security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 04/19/2023 Created 01/11/2024 Added 01/10/2024 Modified 01/28/2025 Description Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords. Solution(s) huawei-euleros-2_0_sp8-upgrade-cloud-init References https://attackerkb.com/topics/cve-2022-2084 CVE - 2022-2084 EulerOS-SA-2023-3116

Red Hat: CVE-2023-1382: kernel: denial of service in tipc_conn_close (Multiple Advisories) Severity 4 CVSS (AV:L/AC:M/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 05/15/2023 Added 05/15/2023 Modified 01/28/2025 Description A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Solution(s) redhat-upgrade-kernel redhat-upgrade-kernel-rt References CVE-2023-1382 RHSA-2023:2148 RHSA-2023:2458 RHSA-2023:6901 RHSA-2023:7077 RHSA-2024:0412 RHSA-2024:1404 View more

Huawei EulerOS: CVE-2023-1382: kernel security update Severity 4 CVSS (AV:L/AC:M/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 05/10/2023 Added 05/10/2023 Modified 01/28/2025 Description A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Solution(s) huawei-euleros-2_0_sp9-upgrade-kernel huawei-euleros-2_0_sp9-upgrade-kernel-tools huawei-euleros-2_0_sp9-upgrade-kernel-tools-libs huawei-euleros-2_0_sp9-upgrade-python3-perf References https://attackerkb.com/topics/cve-2023-1382 CVE - 2023-1382 EulerOS-SA-2023-1873

Huawei EulerOS: CVE-2022-2084: cloud-init security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 04/19/2023 Created 08/10/2023 Added 08/09/2023 Modified 01/28/2025 Description Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords. Solution(s) huawei-euleros-2_0_sp9-upgrade-cloud-init References https://attackerkb.com/topics/cve-2022-2084 CVE - 2022-2084 EulerOS-SA-2023-2606

SUSE: CVE-2021-3429: SUSE Linux Security Advisory Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 04/19/2023 Created 05/11/2023 Added 05/11/2023 Modified 01/28/2025 Description When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user. Solution(s) suse-upgrade-cloud-init suse-upgrade-cloud-init-config-suse References https://attackerkb.com/topics/cve-2021-3429 CVE - 2021-3429

Huawei EulerOS: CVE-2023-2162: kernel security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 04/19/2023 Created 08/10/2023 Added 08/09/2023 Modified 01/28/2025 Description A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Solution(s) huawei-euleros-2_0_sp9-upgrade-kernel huawei-euleros-2_0_sp9-upgrade-kernel-tools huawei-euleros-2_0_sp9-upgrade-kernel-tools-libs huawei-euleros-2_0_sp9-upgrade-python3-perf References https://attackerkb.com/topics/cve-2023-2162 CVE - 2023-2162 EulerOS-SA-2023-2614

VMware Photon OS: CVE-2023-28327 Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/19/2023 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2023-28327 CVE - 2023-28327

Rocky Linux: CVE-2023-2162: kernel-rt (RLSA-2024-0134) Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 04/19/2023 Created 03/07/2024 Added 03/05/2024 Modified 01/28/2025 Description A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Solution(s) rocky-upgrade-kernel-rt rocky-upgrade-kernel-rt-core rocky-upgrade-kernel-rt-debug rocky-upgrade-kernel-rt-debug-core rocky-upgrade-kernel-rt-debug-debuginfo rocky-upgrade-kernel-rt-debug-devel rocky-upgrade-kernel-rt-debug-kvm rocky-upgrade-kernel-rt-debug-modules rocky-upgrade-kernel-rt-debug-modules-extra rocky-upgrade-kernel-rt-debuginfo rocky-upgrade-kernel-rt-debuginfo-common-x86_64 rocky-upgrade-kernel-rt-devel rocky-upgrade-kernel-rt-kvm rocky-upgrade-kernel-rt-modules rocky-upgrade-kernel-rt-modules-extra References https://attackerkb.com/topics/cve-2023-2162 CVE - 2023-2162 https://errata.rockylinux.org/RLSA-2024:0134