RedHat Linux 核心多個漏洞
發佈日期:
2025年03月11日
609
觀看次數
風險: 中度風險
類型: 操作系統 - LINUX
於 RedHat Linux核心發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升及洩露敏感資料。
注意:
CVE-2024-50302 正在被廣泛利用。此漏洞允許攻擊者使用惡意輸入裝置從報告緩衝區讀取資訊。可導致核心內存洩漏，從而利用其他的漏洞。由於利用該漏洞需要與惡意硬件進行物理連接，因此風險等級仍然為中度風險。
影響
- 阻斷服務
- 資料洩露
- 權限提升
受影響之系統或技術
- Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64
- Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4 aarch64
- Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4 s390x
- Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
- Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4 ppc64le
- Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
- Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4 x86_64
- Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
- Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
- Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
- Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
- Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x
- Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
- Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
- Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
- Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
- Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
- Red Hat Enterprise Linux Server - AUS 8.4 x86_64
- Red Hat Enterprise Linux Server - AUS 8.6 x86_64
- Red Hat Enterprise Linux Server - AUS 9.4 x86_64
- Red Hat Enterprise Linux Server - TUS 8.4 x86_64
- Red Hat Enterprise Linux Server - TUS 8.6 x86_64
- Red Hat Enterprise Linux Server - TUS 8.8 x86_64
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
解決方案
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
- https://access.redhat.com/errata/RHSA-2025:2488
- https://access.redhat.com/errata/RHSA-2025:2489
- https://access.redhat.com/errata/RHSA-2025:2490
- https://access.redhat.com/errata/RHSA-2025:2524
- https://access.redhat.com/errata/RHSA-2025:2525
- https://access.redhat.com/errata/RHSA-2025:2528
漏洞識別碼
- CVE-2021-47497
- CVE-2023-52520
- CVE-2023-52615
- CVE-2023-52922
- CVE-2024-26603
- CVE-2024-26744
- CVE-2024-35801
- CVE-2024-43830
- CVE-2024-50275
- CVE-2024-50302
- CVE-2024-53197
資料來源
相關連結
- https://access.redhat.com/errata/RHSA-2025:2488
- https://access.redhat.com/errata/RHSA-2025:2489
- https://access.redhat.com/errata/RHSA-2025:2490
- https://access.redhat.com/errata/RHSA-2025:2524
- https://access.redhat.com/errata/RHSA-2025:2525
- https://access.redhat.com/errata/RHSA-2025:2528
- https://www.cisa.gov/news-events/alerts/2025/03/04/cisa-adds-four-known-exploited-vulnerabilities-catalog
分享至