Linux kernel vulnerabilities

A vulnerability in the Linux kernel SCSI target subsystem affects parsing of PERSISTENT RESERVE OUT buffers. The TransportID parser was not given the buffer length, allowing out-of-bounds reads via a malformed iSCSI identifier. It is reachable through any fabric delivering PR OUT to an iSCSI TPG, including vhost-scsi.

A use-after-free vulnerability was found in the Linux kernel's SCSI target subsystem, affecting the REGISTER AND MOVE operation in Persistent Reserve Out. The issue arises from using a pointer to a mapped buffer after it has been unmapped, potentially leading to reads from freed memory.

In the Linux kernel, the RT locking mechanism has a use-after-free vulnerability due to incorrect RCU protection in rt_spin_unlock(). The function releases RCU protection before unlocking, enabling a race condition that leads to use of freed memory.

In the Linux kernel, the net: mana driver lacks validation of the packet length reported by the NIC in the RX CQE. The length is passed to skb processing without verification, which can lead to errors.

In the Linux kernel, the net: mana driver lacks DMA synchronization for page pool RX fragments in the receive path. When RX buffers are allocated from page pool fragments, they are not synced for CPU before being passed to the network stack, which can cause issues in configurations requiring explicit DMA sync.

A vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver causes header buffer corruption when header-split and HW-GRO are enabled. The issue stems from incorrect indexing of header buffers by queue position instead of buffer ID, leading to wrong header reads and reuse of buffers still owned by the device when completions arrive out of order.

In the Linux kernel ESPINTCP subsystem, a vulnerability exists related to partial sends. Using sk_msg_free_partial() ensures skmsg consistency in each iteration, simplifying code and fixing bugs in skmsg accounting when not sending the full contents.

In the Linux kernel orangefs filesystem, a vulnerability exists where the directory entry size is stored in a 32-bit variable, which can wrap and bypass bounds checks, leading to out-of-bounds read and kernel panic.

In the Linux kernel, in the ip_vs_conn_new() function, the full ip_vs_seq structures are not reset, which can lead to use of uninitialized data from slab. The fix resets both struct ip_vs_seq members before publishing the connection to prevent TCP flow corruption.

In the Linux kernel's DRBD module, there is a vulnerability due to not rejecting data replies with an out-of-range payload size. A malicious or man-in-the-middle DRBD peer can send a reply with a negative size, leading to copying data beyond a bio page and corrupting kernel memory.

In the Linux kernel's IPVS, there are errors in calculating IPv6 transport offsets. The TCP app code assumed an IPv4 network header, which can cause issues with apps over IPv6. The ICMPV6 header offset was also corrected.

In the Linux kernel's IPVS, after calling skb_ensure_writable(), which may reallocate skb->head, the IP header pointer was not reloaded, potentially leading to use of a stale pointer.

In the Linux kernel ksmbd (SMB) server, FSCTL operations such as SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION operate on an open SMB handle but call VFS helpers with the current ksmbd worker credentials. This can lead to revalidation of inode permissions, ownership, and LSM policy independently of the SMB handle access mask. The fix runs each operation with the credentials captured in the target file when the handle was opened.

In the Linux kernel's ksmbd server, there is a missing validation of the minimum PDU size for transform requests. A packet with SMB2_TRANSFORM_PROTO_NUM bypasses the check, potentially leading to out-of-bounds read and disclosure of data to an unauthenticated client.

In the Linux kernel, the xfrm subsystem has a vulnerability where skb->prev becomes stale after async crypto steals a GSO segment. If the last segment is stolen, the head's ->prev pointer is not updated, leading to a write through a dangling pointer (use-after-free) in validate_xmit_skb_list(). The fix repoints skb->prev at the last retained segment before returning.

In the Linux kernel, the SMB client has a vulnerability in the fallocate function that can skip holes when the server returns an allocated range starting before the current offset. This can cause later writes to the skipped area to fail with ENOSPC.

In the Linux kernel on s390 architecture, there is a vulnerability in csum_partial() that on machines without vector facility calculates the checksum from address zero instead of the source buffer. This results in incorrect checksums.

In the Linux kernel, the SMB server (ksmbd) has a use-after-free vulnerability during asynchronous oplock break notification. The pointer to the ksmbd_conn structure is stored in an async work without proper reference counting, which can lead to access to freed memory.

In the Linux kernel, the SMB client's parse_dfs_referrals() did not validate the PathConsumed value in DFS responses. A malicious response with an oversized PathConsumed can cause subsequent DFS path parsing to advance beyond the end of the path.

In the Linux kernel, the AMT (Automatic Multicast Tunneling) module has a use-after-free vulnerability. Several packet receive and transmit paths cache a pointer to the skb header and then call functions that can reallocate the head, leaving the pointer dangling. An attacker could exploit this to escalate privileges or leak information.

In the Linux kernel SCTP subsystem, sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, bypassing authentication verification. The fix checks sctp_auth_recv_cid() in such cases and drops the chunk if authentication is required.

In the Linux kernel, a vulnerability was found in the MPTCP implementation, involving a stale skb->sk pointer to a closing subflow. The backlog cleanup was performed without proper synchronization, which could lead to a use-after-free condition.

In the Linux kernel, SCTP UDP tunnel sockets were not closed during network namespace teardown, potentially leading to races and improper state. The fix closes these sockets in sctp_ctrlsock_exit() after unregistering the sysctl table.

In the Linux kernel, a pre-auth out-of-bounds read vulnerability was found in ceph_handle_caps(). An attacker or compromised MDS can set snaptrace_len to 0xFFFFFFFF, leading to reads beyond the message buffer and further out-of-bounds reads.

In the Linux kernel's libceph module, the length of pg_temp, pg_upmap, and pg_upmap_items lists was not bounded to CEPH_PG_MAX_SIZE, potentially leading to a stack out-of-bounds write. The fix rejects entries longer than 32 during decoding.

In the Linux kernel's libceph module, a multiplication overflow during osdmap decoding can lead to incorrect bounds checking and out-of-bounds reads. The fix uses check_mul_overflow() to detect overflow and reject corrupted messages.

In the Linux kernel's libceph module, after an authorizer update, the auth->authorizer_buf may point to freed memory, leading to a use-after-free. The fix refreshes these pointers after a successful authorizer rebuild.

In the Linux kernel's libceph module, CRUSH bucket type 0 was accepted, potentially leading to indexing the OSD weight array with a negative value. The fix rejects such types during CRUSH map decoding.

In the Linux kernel's phonet module (PEP subsystem), the function pep_get_sb() does not consider that pskb_may_pull() might have relocated the skb data, and continues to access the older pointer, leading to a use-after-free. The issue was confirmed by KASAN.

In the Linux kernel's net/x25 subsystem, there is a use-after-free vulnerability in x25_kill_by_neigh(). The function walks the global X.25 socket list but does not pin the socket's lifetime after dropping the list lock. A concurrent close can free the socket, and the function then uses the freed object. The fix takes a reference with sock_hold() and rechecks the connection.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism allows re-aggregation of packets marked with the flush flag. The lack of validation in skb_gro_receive_list() leads to corruption of the frag_list chain, potentially causing a kernel panic during packet transmission.

In the Linux kernel ILA module, after calling pskb_may_pull(), the IPv6 header pointer may become stale, leading to use-after-free. The fix reloads the pointer after each pskb_may_pull().

A vulnerability in the Linux kernel's MCTP serial driver allows zero-length frames to bypass validation and cause out-of-bounds writes. An attacker with CAP_NET_ADMIN can trigger a buffer overflow via the tty receive path.

In the Linux kernel openvswitch module, during GSO segmentation for userspace actions, a length underflow can occur, leading to incorrect skb_zerocopy() behavior. The fix stores the maximum preserved length and bounds consumers.

In the Linux kernel, the tipc_sk_create() function fails to clear sock->sk on the failed-insert path, leading to a use-after-free in the accept() path. The issue occurs when the socket hash table reaches its maximum size (about 2 million sockets per network namespace).

In the Linux kernel, the ksmbd (SMB) server has a vulnerability in path resolution in ksmbd_vfs_kern_path_create. An attacker can use '..' components to escape the shared resource, leading to privilege escalation or unauthorized access.

In the Linux kernel, the decode_lockers() function in libceph contains two unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before reading the locker count and lock type can lead to unauthorized memory reads. The vulnerability is fixed by replacing the unsafe operations with safe variants that include bounds checking.

In the Linux kernel, the SMB client has a double-free vulnerability in SMB2_close() during replay. If a response-bearing attempt returns a replayable error and frees its response buffer, and then SMB2_close_init() fails before the next send, the buffer is freed again.

In the Linux kernel, xfrm iptfs fails to propagate the SKBFL_SHARED_FRAG flag when copying fragments in iptfs_skb_add_frags(). If the source SKB has shared fragments, the new inner SKB may be incorrectly treated as having private fragments, leading to writes to memory still referenced by the outer SKB. The fix sets the flag in the loop after each fragment addition.

In the Linux kernel, a use-after-free vulnerability exists in SCTP's ASCONF processing. An attacker can send a crafted ASCONF packet that frees the transport used for processing, then leverages the dangling pointer, leading to memory corruption and potential code execution.

In the Linux kernel, SCTP's handling of STALE_COOKIE error in COOKIE_ECHOED state reads the staleness field from the first error cause instead of the STALE_COOKIE cause, leading to out-of-bounds read and uninitialized memory leak.

A use-after-free (UAF) vulnerability was found in the Linux kernel's smc_cdc_rx_handler() function for the SMC-R protocol. The issue occurs because no socket reference is held after releasing the conns_lock, allowing a concurrent close() to free memory before sock_hold() is called.

In the NVMe/TCP subsystem of the Linux kernel, when a data digest mismatch occurs on a non-final H2C_DATA PDU, nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() without marking the command as completed. This leads to a double call to nvmet_req_uninit() during queue teardown, resulting in a double free and potential use-after-free (UAF).

In the NVMe/TCP subsystem of the Linux kernel, in nvmet_tcp_try_recv_ddgst(), the call to nvmet_req_uninit() is unconditional. If the command arrived via the nvmet_tcp_handle_req_failure() path, the percpu_ref was never taken, leading to a refcount underflow and potential use-after-free.

A vulnerability in the Linux kernel involves the TC_ACT_CONSUMED case in the tcf_qevent_handle function in net/sched/cls_api.c. When tcf_classify() returns TC_ACT_CONSUMED, the skb is held by the defragmentation engine and must not be touched further. Missing handling leads to a use-after-free (UAF) in red_enqueue().

In the Linux kernel net/handshake mechanism, a long-lived file reference was missing during handshake request processing. Using sock_hold() did not protect the socket structure from being destroyed by the consumer, potentially leading to use-after-free.

In the Linux kernel, the tcp_ao_destroy_sock function removed the call_rcu() call, breaking RCU synchronization. During connection setup (TCP_SYN_SENT), the socket is visible to other CPUs, which may read the ao_info pointer just before it is freed, leading to a use-after-free vulnerability.

In the Linux kernel, a vulnerability in the TIPC broadcast mechanism allows an out-of-bounds read. The tipc_get_gap_ack_blks() function fails to verify that the Gap ACK block record fits within the message data area, enabling an attacker to trigger a kmemdup() read beyond the allocated skb buffer.

In the Linux kernel's crypto: krb5 module, a use-after-free occurs when using async AEAD implementations. Cryptographic functions set a NULL callback and treat any negative return as an error, freeing the buffer. When the implementation is async, it returns -EINPROGRESS and the buffer is freed while the backend still uses it.

In the Linux kernel netfilter flowtable subsystem, hardware offload for IPIP tunnels is not yet supported. Despite this, offload attempts are queued to a worker and then ignored, causing unnecessary overhead. The patch adds early checking and bail-out for IPIP tunnel offload.