Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

A user-after-free vulnerability was found in the linux kernel. sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, leading to a crash and loss of availability of the system.

CWE-416 - Use After Free

A flaw was found in the Linux kernel's ip6_gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspan_changelink() function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original network namespace is destroyed, potentially resulting in a kernel bug and system instability or denial of service.

CWE-763 - Release of Invalid Pointer or Reference

A flaw was found in the Linux kernel's Pressure Stall Information (PSI) subsystem. A race condition exists between the file release and pressure write operations, specifically concerning the `priv` member of `struct kernfs_open_file`. This can lead to a use-after-free vulnerability or a NULL dereference, potentially causing system instability or a denial of service. The issue arises when the `priv` member is deallocated during a cgroup file release while a pressure write operation attempts to access it, or when it becomes NULL before being accessed.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in the Linux kernel's memory management, specifically within the huge page mechanism. When a huge page is split, the system updates a counter after releasing a reference to the memory. This timing issue can lead to the system attempting to read from memory that has already been freed, potentially resulting in memory corruption or information disclosure.

CWE-364 - Signal Handler Race Condition

A flaw was found in the Linux kernel's iSCSI (Internet Small Computer System Interface) target functionality. This vulnerability, a heap overrun, occurs because the iscsi_encode_text_output() function does not properly check buffer capacity when processing login requests. A remote attacker could exploit this by sending a specially crafted login request with numerous key-value pairs, leading to a memory corruption issue and potentially a denial of service (DoS) on the system.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A flaw was found in the Linux kernel's iSCSI (Internet Small Computer System Interface) target subsystem. This vulnerability involves a buffer overread and a double-free error when processing iSCSI Text commands. A remote attacker could exploit these issues by sending specially crafted network packets, leading to a kernel crash or memory corruption. This could result in a Denial of Service (DoS) for the affected system.

CWE-125 - Out-of-bounds Read

A flaw was found in the Linux kernel's Server-Message-Block Direct (SMC-D) client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier (CHID) of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC connection creation process, leading to a system crash and a Denial of Service (DoS).

CWE-476 - NULL Pointer Dereference