Red Hat Security Advisory: kernel security update

Important

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the `nf_conntrack_helper`. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. A local attacker could exploit this to cause a system crash, resulting in a Denial of Service (DoS), or potentially achieve privilege escalation.

CWE-459 - Incomplete Cleanup

A flaw was found in the Linux kernel. When the kernel's real-time mutex (rtmutex) component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' (UAF) vulnerability, where the system attempts to use memory that has already been released. A local attacker could potentially exploit this to gain elevated privileges or execute unauthorized code.

CWE-825 - Expired Pointer Dereference

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 shadow paging mechanism. This use-after-free vulnerability arises from incorrect handling of Guest Frame Numbers (GFNs) when guest page tables are modified. A local attacker with control over a guest virtual machine could exploit this to dereference freed memory, potentially leading to information disclosure, privilege escalation, or a denial of service (DoS).

CWE-416 - Use After Free

A flaw was found in the Linux kernel's futex (Fast Userspace Mutex) requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance (PI) futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the `remove_waiter()` function during a self-deadlock scenario, leads to a kernel crash, resulting in a Denial of Service (DoS).

CWE-476 - NULL Pointer Dereference

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry (PDE) mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a use-after-free condition, where the system attempts to access memory that has already been released. Such a condition can lead to system instability, denial of service, potentially the execution of arbitrary code or guest-to-host escape.

CWE-825 - Expired Pointer Dereference