Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Moderate

An information disclosure flaw was found in the Linux kernel. The i915 graphics driver lacks control of flow for data structures which may allow a local, authenticated user to disclose information when using ioctl commands with an attached i915 device. The highest threat from this vulnerability is to data confidentiality.

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

A flaw was found in the Linux kernel. In Overlayfs, vma->vm_file was replaced in the mmap handlers and, on errors, the original value is not restored. A local attacker with special user privilege (or root) can cause a kernel internal information leak. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CWE-672 - Operation on a Resource after Expiration or Release

A flaw was found in the Linux pinctrl system. It is possible to trigger an of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed.

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux may allow an authenticated user to potentially enable a denial of service via local access.

CWE-20 - Improper Input Validation

Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux may allow an authenticated user to potentially enable information disclosure via local access.

CWE-863 - Incorrect Authorization

An uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux may allow an authenticated user to potentially cause a denial of service via local access.

CWE-400 - Uncontrolled Resource Consumption