This advisory covers multiple vulnerabilities in .NET 8.0 on Red Hat Enterprise Linux 8. The critical issue (CVE-2024-38229) involves a race condition when closing an HTTP/3 stream in the Kestrel server, which can lead to remote code execution. Additional vulnerabilities include hash flooding attacks affecting multiple .NET components (CVE-2024-43483), and denial of service vectors in System.IO.Packaging (CVE-2024-43484) and System.Text.Json (CVE-2024-43485). Red Hat has released updated packages (SDK 8.0.110 and Runtime 8.0.10) to fix these issues. The advisory references multiple architectures including x86_64, s390x, ppc64le, and aarch64 for Red Hat Enterprise Linux 8 and related CodeReady Linux Builder variants.

The race condition in Kestrel HTTP/3 stream handling can allow remote attackers to execute code on affected systems. The hash flooding vulnerabilities and denial of service issues can cause service disruptions or crashes. These vulnerabilities collectively pose a high security risk by enabling remote code execution and denial of service attacks on systems running vulnerable .NET versions on Red Hat Enterprise Linux 8.

Red Hat has released updated .NET SDK 8.0.110 and Runtime 8.0.10 packages that address these vulnerabilities. Users should apply these official patches promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official fixes.