Red Hat Security Advisory: kernel security update

Important

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. Due to incorrect memory allocation for IPv6 subflow child sockets, a use-after-free vulnerability exists. A remote attacker could exploit this by triggering concurrent lookups in the kernel's hash table, potentially leading to a denial of service or arbitrary code execution.

CWE-763 - Release of Invalid Pointer or Reference

A flaw was found in the Linux kernel. A buffer overflow vulnerability exists in the Xen hypervisor driver (`drivers/xen/sys-hypervisor.c`). This flaw occurs because the `HYPERVISOR_xen_version(XENVER_build_id)` function returns a build ID that is not properly null-terminated. When the `buildid_show` function attempts to process this non-null-terminated string using `sprintf`, it can read and copy beyond the intended buffer boundary, potentially leading to a denial of service or other unspecified impacts.

CWE-170 - Improper Null Termination

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a `privcmd` memory region. This action causes a Virtual Memory Area (VMA) to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed twice, a condition known as a double free, which can cause system instability or a denial of service.

CWE-763 - Release of Invalid Pointer or Reference

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. This vulnerability occurs because the driver fails to properly validate bsscfg indices in interface (IF) events. An attacker could exploit this by sending a specially crafted IF event with an invalid bsscfg index, which could lead to an out-of-bounds write or read, potentially causing a system crash and resulting in a denial of service (DoS).

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input