Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

A use-after-free vulnerability was found in the Linux kernel. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. However, it is possible to create two resources with different types but the same handle, for example, the same context and resource fields. When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle().vmci_resource_table will still hold a pointer to this freed resource, leading to a use-after-free issue.

CWE-416 - Use After Free

In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in con_font_get() font.data may not initialize all memory spaces depending on the implementation of vc->vc_sw->con_font_get. This may cause info-leak, so to prevent this, it is safest to modify it to initialize the allocated memory space to 0, and it generally does not affect the overall performance of the system.

CWE-909 - Missing Initialization of Resource

A flaw was found in the Linux kernel’s Bluetooth subsystem (HCI). Specifically, in the function hci_acl_create_conn_sync() (and related path hci_le_create_conn_sync()), a connection object in state BT_OPEN that is still pending command submission may be freed prematurely, leading to a use-after-free condition. An attacker with network privileges could exploit this to trigger memory corruption, a denial of service, or a potential escalation of privileges.

CWE-416 - Use After Free