Description
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux10.0 – 10.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / hardened_images
- RedHat / openshift_container_platform4.0 – 4.0
- smuellerDD / libkcapi0.12.0 – 1.5.1
- Stephan Muelle / libkcapi0.12.0 – 1.5.1
References
Updated 17m ago · 8 sources