Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

A flaw was found in the Linux kernel’s sof_set_get_large_ctrl_data function, in the way it handled memory cleanup in a specific error path. A local attacker could use this flaw to crash the system.

CWE-400 - Uncontrolled Resource Consumption

A flaw was found in the Linux kernel’s implementation for ADU devices from Ontrak Control Systems, where an attacker with administrative privileges and access to a local account could pre-groom the memory and physically disconnect or unload a module. The attacker must be able to access either of these two events to trigger the use-after-free, and then race the access to the use-after-free, to create a situation where key USB structs can be manipulated into corrupting memory.

CWE-476 - NULL Pointer Dereference

A use-after-free flaw was found in iowarrior_disconnect in iowarrior USB driver module were a flag was simultaneously modified causing a race between a device open and disconnect. This flaw could allow a physical attacker to cause a denial of service (DoS) attack. This vulnerability could even lead to a kernel information leak problem.

CWE-416 - Use After Free

A flaw out of bounds write in the Linux kernel human interface devices subsystem was found in the way user calls find key code by index. A local user could use this flaw to crash the system or escalate privileges on the system.

CWE-284 - Improper Access Control