A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a     cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called     at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular     dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may     allow an attacker with a local access to cause system instability, such as an out of memory error.
    (CVE-2024-0443)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6583 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

    * kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

    * Kernel: race when faulting a device private page in memory manager (CVE-2022-3523)

    * kernel: use-after-free in l1oip timer handlers (CVE-2022-3565)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: vmwgfx: use-after-free in vmw_cmd_res_check (CVE-2022-38457)

    * kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context (CVE-2022-40133)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c (CVE-2022-42895)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove() (CVE-2023-1079)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (CVE-2023-1652)

    * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font() (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() (CVE-2023-3772)

    * kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr (CVE-2023-3773)

    * kernel: KVM: SEV-ES / SEV-SNP VMGEXIT double fetch vulnerability (CVE-2023-4155)

    * kernel: exFAT: stack overflow in exfat_get_uniname_from_ext_entry (CVE-2023-4273)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: KVM: nVMX: missing consistency checks for CR0 and CR4 (CVE-2023-30456)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() (CVE-2023-33203)

    * kernel: vmwgfx: race condition leading to information disclosure vulnerability (CVE-2023-33951)

    * kernel: vmwgfx: double free within the handling of vmw_buffer_object objects (CVE-2023-33952)

    * kernel: r592: race condition leading to use-after-free in r592_remove() (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: tap: tap_open(): correctly initialize socket uid (CVE-2023-1076)

    * kernel: missing mmap_lock in file_files_note that could possibly lead to a use after free in the     coredump code (CVE-2023-1249)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode() (CVE-2023-3212)

    * kernel: NULL pointer dereference due to missing kalloc() return value check in     shtp_cl_get_dma_send_buf() (CVE-2023-3358)

    * kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid     (CVE-2023-4194)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7370 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207,     CVE-2023-4208)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: AMD: Cross-Thread Return Address Predictions (CVE-2022-27672)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL9.0.z - kdump service failed to start when 32TB lpar is activated with desired_memory 100gb and max     memory 32TB. (BZ#2192539)

    * RHEL 9.0 - system hang during 6th EEH (BZ#2192561)

    * RHEL9.0 - kernel: fix __clear_user() inline assembly constraints (BZ#2192599)

    * LPAR is crashed by Phyp when doing DLPAR CPU operations (BZ#2193372)

    * RHEL 9.2 - Wrong numa_node is assigned to vpmem device (BZ#2212450)

    * Rhel9.2 - drmgr command  is failing (BZ#2213789)

    * [Intel 9.2] IOMMU: QAT Device Address Translation Issue with Invalidation Completion Ordering     (BZ#2221161)

    * [RHEL9.3] intel_pstate may provide incorrect scaling values for hybrid capable systems with E-cores     disabled (BZ#2221268)

    * [DELL SFSS] NVMe-TCP: kernel panic during connect/delete_controller tests (BZ#2227780)

    * LPM of RHEL client lpar got failed with error HSCLA2CF in 19th loops (BZ#2230270)

    * rbd: exclusive lock blocklisting and osd_request_timeout handling fixes (BZ#2231460)

    * openvswitch needs a stable hash in the kernel module (BZ#2232136)

    * [Intel 9.3] iavf: Driver Update (BZ#2232387)

    * [openvswitch] Add drop reasons to openvswitch (BZ#2233104)

    * [RHEL9] Percpu counter usage is gradually getting increasing during podman container recreation     (BZ#2233214)

    * enable conntrack clash resolution for GRE (BZ#2233799)

    * [Hyper-V][RHEL-9] hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion()     (BZ#2234834)

    * [e1000e] Intel 219-LM need to disable TSO to increase the speed (BZ#2235668)

    * Update lpfc 14.2.0.12 for RHEL 9.3 Inbox with 6 bug fixes from 14.2.0.14 (BZ#2235785)

    * backport 'Revert softirq: Let ksoftirqd do its job' from upstream (BZ#2236415)

    * NAT sport clash in OCP causing 1 second TCP connection establishment delay (BZ#2236513)

    * RHEL9.2 RC build - LTP test via SLS suite fails with a crash after running for 19hrs (BZ#2236699)

    * Container CPU affinity not set properly on Openshift using RHEL 9.2 (BZ#2236859)

    * NFSv4.0 client hangs when server reboot while client had outstanding lock request to the server     (BZ#2237841)

    * VMs deployed with RT workloads getting interrupted - vmstat_update (BZ#2238026)

    * core: backports from upstream (BZ#2238027)

    * SCSI updates for RHEL 9.3 (BZ#2238410)

    * Regression of 3b8cc6298724 (blk-cgroup: Optimize blkcg_rstat_flush()) (BZ#2238721)

    * NOHZ_FULL, and CFS quota co-existance (BZ#2240227)

    * Kernel doesn't boot on AWS SEV-SNP enabled instances (BZ#2241202)

    * RHEL 9.2 crash issue when creating SR-IOV VFs from E810 in switchdev mode (BZ#2241879)

    Enhancement(s):

    * [Intel 9.3 FEAT] [EMR] power: Add EMR support to intel_rapl and intel_idle drivers (BZ#2230167,     BZ#2230168)

    * [Intel 9.3 FEAT] [EMR] power: intel-speed-select tool support for EMR (BZ#2230170)

    * [Intel 9.3 FEAT] [EMR] RAS: Add EDAC support for EMR (BZ#2230172)

    * [RHEL 9.3 FEAT] update turbostat to upstream 6.3 (BZ#2230174)

    * [Lenovo 9.3 FEAT] drivers/nvme - Update to the latest upstream (BZ#2231219)

    * [Intel 9.4 FEAT] [EMR] Support intel-uncore-frequency driver (BZ#2239450)

    * ice: Enable DPLL support (BZ#2242556)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7077 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206,     CVE-2023-4207, CVE-2023-4208)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)

    * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)

    * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)

    * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)

    * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)

    * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)

    * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)

    * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)

    * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

    * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)

    * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)

    * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)

    * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)

    * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)

    * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
227438	Linux Distros Unpatched Vulnerability : CVE-2024-0443	Nessus	Misc.	medium
194262	RHEL 9 : kernel (RHSA-2023:6583)	Nessus	Red Hat Local Security Checks	high
186041	RHEL 9 : kernel (RHSA-2023:7370)	Nessus	Red Hat Local Security Checks	high
185679	RHEL 8 : kernel (RHSA-2023:7077)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-0443

medium

Tenable Plugins

medium

high

high

high