A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. Quoting ZDI security advisory [1]: "This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of GEM objects. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to disclose information in the context of the kernel." [1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-20110/
Upstream fix: https://github.com/torvalds/linux/commit/9ef8d83
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6901 https://access.redhat.com/errata/RHSA-2023:6901
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7077 https://access.redhat.com/errata/RHSA-2023:7077
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404