Описание
In the Linux kernel, the following vulnerability has been resolved:
drm/shmem-helper: Remove another errant put in error path
drm_gem_shmem_mmap() doesn't own reference in error code path, resulting
in the dma-buf shmem GEM object getting prematurely freed leading to a
later use-after-free.
A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) shared memory helper. An incorrect reference count decrement in the drm_gem_shmem_mmap() error-handling path causes shared memory objects to be freed prematurely. A local user could exploit this vulnerability to trigger a use-after-free condition, resulting in a system crash and Denial of Service (DoS) or potential arbitrary code execution.
Отчет
A moderate use-after-free flaw was found in the Linux kernel's Direct Rendering Manager (DRM) shared memory helper, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9. In the error-handling path of drm_gem_shmem_mmap(), a reference that the function does not own is released, causing a dma-buf shmem GEM object to be freed prematurely and leading to a later use-after-free. A local user could exploit this flaw to crash the system (denial of service); while the upstream record notes potential arbitrary code execution, Red Hat's CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) assesses the impact as availability only, which is lower than the 7.8 severity rated by NIST and CVE.org. Fixes for Red Hat Enterprise Linux 8 and 9 are currently deferred to a future kernel update; because exploitation requires authenticated local access and the flaw is rated moderate, the residual risk is limited to a local user causing a system crash or denial of service. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those products.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2023:7077 | 14.11.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free.
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free.
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free.
EPSS
5.5 Medium
CVSS3