Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfd_event_page_set() function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a write beyond its allocated memory. Successful exploitation of this flaw could lead to potential privilege escalation.

CWE-787 - Out-of-bounds Write

A flaw was found in the Linux kernel's `nf_conntrack_h323` helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the `nf_conntrack_h323` helper active. This memory corruption vulnerability leads to an out-of-bounds read, which can result in a heap-buffer-overflow.

CWE-131 - Incorrect Calculation of Buffer Size

A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. Incorrect management of graphics memory (dma_fence) references within the `amdgpu_gem_va_ioctl` function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger a kernel panic, causing the system to crash and resulting in a denial of service.

CWE-911 - Improper Update of Reference Count