CVE-2022-3564
CVE-2022-3564
Fix for CVE-2022-3564 (kernel is Vulnerable) has been released for RHEL 7 on 19 July 2023.
This is not yet available for CentOS.
Does next batch of updates for CentOS 7 contains fix for this?
This is not yet available for CentOS.
Does next batch of updates for CentOS 7 contains fix for this?
Re: CVE-2022-3564
kernel 3.10.0-1160.95.1.el7.x86_64 is indeed one of the updates that is pending release. Currently stuck on failing CI tests I think.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Re: CVE-2022-3564
Just released.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Re: CVE-2022-3564
Thank you for the update TrevorH.
-
- Posts: 3
- Joined: 2023/08/24 20:23:28
Re: CVE-2022-3564
I just updated my kernel to 3.10.0-1160.95.1.el7.x86_64, but our security scanner (Kenna) still flags it as containing this CVE.
Could someone please confirm that this kernel contains the patch for the CVE?
Or, is there something different that I need to apply?
Thanks in advance
Could someone please confirm that this kernel contains the patch for the CVE?
Or, is there something different that I need to apply?
Thanks in advance
Re: CVE-2022-3564
rpm -q --changelog kernel-$(uname -r) on a system running that kernel says
What does uname -r say on your machine?* Mon Jun 05 2023 Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.93.1.el7]
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Wander Lairson Costa) [2152941] {CVE-2022-3564}
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Re: CVE-2022-3564
Does Kenna belong to the group of "some tools" that Red Hat mentions in: https://access.redhat.com/solutions/57665
-
- Posts: 3
- Joined: 2023/08/24 20:23:28
Re: CVE-2022-3564
uname output for my system:
# uname -r
3.10.0-1160.95.1.el7.x86_64
# uname -r
3.10.0-1160.95.1.el7.x86_64
-
- Posts: 3
- Joined: 2023/08/24 20:23:28
Re: CVE-2022-3564
I ran the rpm -q -changelog kernel-$(uname -r) | grep "CVE-2022-3564"
it returns
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Wander Lairson Costa) [2152941] {CVE-2022-3564}
I can't attach the entire file -- says too large.
That makes me think this vulnerability should be fixed
it returns
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Wander Lairson Costa) [2152941] {CVE-2022-3564}
I can't attach the entire file -- says too large.
That makes me think this vulnerability should be fixed
Re: CVE-2022-3564
Sounds like a problem with the security scanner then.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke