Red Hat Enterprise Linux For Real Time vulnerabilities

43 CVEs affecting Red Hat Enterprise Linux For Real Time, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6536, published 2024-02-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability, published 2022-03-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 92.8% chance of exploitation in the next 30 days. A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus…
CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2022-0435, published 2022-03-25. High severity, CVSS 8.8. EPSS: 67.8% chance of exploitation in the next 30 days. A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64…
CVE-2017-18017, published 2018-01-03. Critical severity, CVSS 9.8. EPSS: 52.8% chance of exploitation in the next 30 days. The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and…
CVE-2019-10126, published 2019-06-14. Critical severity, CVSS 9.8. EPSS: 6.8% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly…
CVE-2018-20784, published 2019-02-22. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have…
CVE-2016-3707, published 2016-06-27. High severity, CVSS 8.1. EPSS: 3.4% chance of exploitation in the next 30 days. The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for…
CVE-2019-9506, published 2019-08-14. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This…
CVE-2023-0179, published 2023-03-27. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege…
CVE-2019-3460, published 2019-04-11. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.

Latest

CVE-2023-6536, published 2024-02-07. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to…
CVE-2023-6535, published 2024-02-07. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to…
CVE-2023-6356, published 2024-02-07. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to…
CVE-2023-5633, published 2023-10-23. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a…
CVE-2023-4732, published 2023-10-03. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG…
CVE-2023-4147, published 2023-08-07. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the…
CVE-2023-4132, published 2023-08-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user…
CVE-2023-3772, published 2023-07-25. Medium severity, CVSS 4.4. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL…
CVE-2023-33952, published 2023-07-24. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior…
CVE-2023-33951, published 2023-07-24. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing…