Red Hat Enterprise Linux 8 update for kernel-rt

Published: 2025-01-08

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-53088 CVE-2024-53122
CWE-ID	CWE-401 CWE-369
Exploitation vector	Local
Public exploit	N/A
Vulnerable software	Red Hat Enterprise Linux for Real Time for NFV Operating systems & Components / Operating system Red Hat Enterprise Linux for Real Time Operating systems & Components / Operating system kernel-rt (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Memory leak

EUVDB-ID: #VU100705

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53088

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the i40e_count_filters(), i40e_correct_mac_vlan_filters(), i40e_correct_vf_mac_vlan_filters(), i40e_aqc_broadcast_filter() and i40e_sync_vsi_filters() functions in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Real Time for NFV: 8

Red Hat Enterprise Linux for Real Time: 8

kernel-rt (Red Hat package): before 4.18.0-553.34.1.rt7.375.el8_10

CPE2.3

External links

https://access.redhat.com/errata/RHSA-2025:0066

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Division by zero

EUVDB-ID: #VU101111