Linux kernel vulnerabilities

In the Linux kernel, the memory driver for Tegra124 (tegra124-emc) had a reversed check for DLL enable in the EMRS register. DLL is enabled when bit A0 is low, but the code checked the opposite.

In the Linux kernel's OCFS2 filesystem and its DLM (Distributed Lock Manager) component, a vulnerability was found due to missing validation of the `qr_numregions` field in the `dlm_match_regions()` function. An attacker can send a crafted DLM_QUERY_REGION network message with an inflated `qr_numregions` value, causing an out-of-bounds read beyond the `qr_regions` buffer.

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module's smb2_open function during durable reconnect. Premature release of the file descriptor reference leads to use of freed memory when accessing file properties upon error or scavenger access.

A vulnerability was found in the Linux kernel's icmpv6_rcv() function for IPv6. Caching source and destination addresses before calling pskb_pull() can lead to a use-after-free (UAF) because pskb_pull() may change the skb->head pointer.

In the Linux kernel netfilter/conntrack subsystem, a stack buffer overflow was found in the mangle_content_len() function. The fix replaces sprintf() with scnprintf() and increases the buffer size.

In the Linux kernel, a vulnerability in the netfilter nfnetlink_osf module causes an out-of-bounds read during TCP option matching. The bug occurs because the shared ctx->optp pointer is not restored after early return in nf_osf_match_one(), leading to garbage data reads and incorrect logging when NF_OSF_LOGLEVEL_ALL is enabled.

In the Linux kernel, a double-free vulnerability in tipc_buf_append() due to tipc_msg_validate() reallocating the buffer. This can lead to memory corruption and potentially privilege escalation.

In the Linux kernel's NVMe-over-TCP driver, a vulnerability was found where nvmet_tcp_build_pdu_iovec() fails to propagate errors (e.g., out-of-bounds PDU length) to its callers. Consequently, callers like nvmet_tcp_handle_h2c_data_pdu() proceed with an uninitialized message iterator, potentially reading network data into an invalid buffer.

In the Linux kernel, unsafe use of simple_strtoul in nf_conntrack_sip was replaced with a new port validation function. The fix prevents out-of-bounds memory access and rejects malformed or overly long port numbers.

A use-after-free vulnerability was discovered in the Linux kernel's rtl8150 driver for USB Ethernet devices. The issue occurs when rtl8150_start_xmit() reads skb->len after usb_submit_urb() is called, while the skb buffer has already been freed by the USB completion handler. This can lead to memory corruption and potential privilege escalation.

In the Linux kernel, a potential out-of-bounds access vulnerability was found in the osdmap_decode() function of the libceph library. The ceph_decode_need() check did not account for the correct number of elements, which could lead to reading beyond the allocated buffer when processing a crafted OSD map message.

In the Linux kernel, the crush_decode() function in libceph is vulnerable to an out-of-bounds access when two fields specifying the bucket algorithm in a CRUSH map differ. This can lead to memory corruption and potential exploitation.

In the Linux kernel, the batman-adv tp_meter module has a vulnerability where uninitialized sender-specific variables are used in batadv_tp_recv_ack() and batadv_tp_stop() when called on a receiver role. A malicious ACK packet can trigger undefined behavior.

A use-after-free vulnerability was found in the Linux kernel's SCTP implementation. When handling a Stale Cookie error (transition from COOKIE_ECHOED to COOKIE_WAIT), the outqueue is not purged, leaving stale scheduler pointers. An attacker can trigger a kernel crash by sending a crafted SCTP packet.

In the Linux kernel, the batman-adv module has a vulnerability due to incorrect payload length accounting during fragment reassembly. This flaw allows malformed fragment chains to bypass validation, potentially causing a local denial of service.

In the Linux kernel, the RDMA/rxe driver has a vulnerability due to incorrect iova-to-va conversion for memory regions (MR) with page sizes different from PAGE_SIZE. This bug causes wrong pointer calculations during memory access, potentially leading to a kernel panic.

In the Linux kernel, KVM/arm64 vgic-its has a bug in vgic_its_invalidate_cache() that can drop the same reference multiple times during concurrent cache invalidation, leading to use-after-free.

In the Linux kernel, a bug in the extract_kvec_to_sg function within the scatterlist library causes incorrect length calculations when extracting data from a kvec to a scatterlist. This can result in an sglist entry exceeding the page size, which is unintended. The vulnerability was introduced in kernel v6.3 and affects v6.5+.

In the Linux kernel, a vulnerability in RAW sockets using IPPROTO_RAW allows malicious ICMP packets to set the protocol field to 255 and match such a socket, leading to FNHE cache changes.

In the Linux kernel netfilter nft_inner module, there is a desynchronization between the transport offset and layer 4 protocol for inner IPv6 packets. The bug overwrites the correct offset calculated by ipv6_find_hdr() with a constant 40 bytes, enabling transport header forgery and potential firewall bypass. This affects stable kernel versions from 6.2.

A use-after-free (UAF) vulnerability was found in the Linux kernel's eventpoll (epoll) mechanism. The bug occurs in ep_remove() which, after clearing the file->f_ep pointer, may still use the file structure while a concurrent __fput() can free it, leading to writes into freed memory. An attacker can exploit this to trigger a controlled kmem_cache_free() on the wrong slab cache.

In the Linux kernel's CIFS/SMB subsystem, a vulnerability was found due to missing validation of the DACL offset (dacloffset) before constructing DACL pointers. A malicious server can supply a dacloffset near U32_MAX, causing pointer wrapping on 32-bit builds and bypassing bounds checks, potentially leading to out-of-bounds memory access.

A vulnerability has been identified in the Linux kernel affecting the symlink_data() function. The issue arises from a lack of length validation for the symlink error response, which may lead to out-of-bounds reads.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the smb2_compound_op() function. The issue occurs when a server sends a truncated response with a large OutputBufferLength, potentially leading to kernel memory leakage.

A vulnerability in the Linux kernel related to mptcp has been resolved, concerning the mptcp_pm_add_timer() function executed as a timer callback in softirq context. To avoid data races, the socket lock needs to be held with bh_lock_sock().

A race condition was found in the Linux kernel's NVMe/TCP driver (nvmet-tcp) between ICReq handling and queue teardown. Lack of synchronization allows overwriting the queue state, leading to a double kref_put and potential memory corruption.

A vulnerability in the Linux kernel related to out-of-bounds memory access in authentication message processing has been fixed. The issue occurred when a CEPH_MSG_AUTH_REPLY message contained a positive value in its result field, leading to improper processing and sending data beyond the allocated buffer.

A vulnerability has been identified in the Linux kernel within the biovec_phys_mergeable() function, which does not check if bvec segments belong to different dev_pagemaps. This can lead to memory management errors when segments are physically contiguous.

A vulnerability has been identified in the Linux kernel within the rxe_rcv function, which improperly validates the packet length before calculating the payload size. An attacker could exploit this to trigger an underflow error, potentially leading to security issues.

In the Linux kernel, a potential integer overflow in the rxgk_extract_token() function when checking the length of the ticket has been fixed. Instead of rounding up the value to be tested, the size of the available data is rounded down.

A vulnerability related to the re-decryption of RESPONSE packets has been fixed in the Linux kernel. If a RESPONSE packet encounters a temporary failure during processing, it may end up in a partially decrypted state and be requeued for retry.

A vulnerability was found in the Linux kernel's smb2_open_file() function in the SMB client. Failure to zero out @err_iov and @err_buftype pointers before retrying SMB2_open() can lead to a use-after-free (UAF) or double free when @data is not NULL.

In the Linux kernel RDMA/iwcm subsystem, a vulnerability causes workqueue list corruption. The issue stems from the incorrect assumption that queue_work() would not enqueue work if already pending, while each iwcm_work object has a unique work_struct. This allows multiple entries to be processed in a single handler run, freed to the free list, and reused, leading to list corruption.

An attacker sending TCP, IL, RUDP, or GRE packets with a length less than the header size can trigger a kernel panic.

In the Linux kernel, a vulnerability exists in handling the IPv6 Source Routing Header (SRH). During decompression and recompression of SRH, if the recompressed header is larger than the received one, an out-of-bounds write can occur in ipv6_rthdr_rcv. The issue arises when headroom is insufficient, leading to memory corruption.

In the Linux kernel, a vulnerability was found in the RxRPC protocol implementation where DATA and RESPONSE packet handlers did not check for shared page fragments (e.g., from splice()). This allowed in-place decryption on shared pages, potentially leading to data integrity issues.

In the Linux kernel, a double free of the fcport structure was found in the qla2xxx SCSI driver. The function qla2x00_els_dcmd_sp_free() frees fcport, and a subsequent kref_put() call triggers a second free, potentially causing memory corruption.

In the Linux kernel, libceph's process_message_header() could perform out-of-bounds reads if the message frame was maliciously corrupted so that the control segment length was smaller than the message header size, or a different frame was made to look like a message frame. An explicit bounds check was added before decoding the message header.

A use-after-free vulnerability was fixed in the Linux kernel's kthread mechanism. When a kthread exited via make_task_dead(), it bypassed kthread_exit() and missed affinity_node cleanup, causing memory to be freed while the node was still linked into the global kthread_affinity_list. A subsequent list_del() by another kthread wrote through dangling list pointers into the freed and reused memory, corrupting the pid's rcu.func pointer.

A vulnerability in the Linux kernel related to MAC comparison in the tcp-md5 protocol has been fixed to prevent timing attacks.

A vulnerability has been identified in the Linux kernel affecting the smb_lazy_parent_lease_break_close() function. The opinfo pointer is accessed after the RCU read unlock, leading to race conditions and potential use-after-free.

A vulnerability has been identified in the Linux kernel that allows for a buffer overflow in the ioam6_fill_trace_data() function. The issue arises from improper storage of the schema length, leading to a bypass of the remaining space check in the trace buffer.

In the Linux kernel, libceph did not verify the key length when decoding the key, which could exceed a fixed-size buffer in process_auth_done(). A new CEPH_MAX_KEY_LEN constant and length check were introduced, replacing the previous check for missing key material.

A vulnerability was found in the Linux kernel's ESP (Encapsulating Security Payload) implementation for IPv4/IPv6. The UDP datagram append paths did not mark shared pipe pages with the SKBFL_SHARED_FRAG flag, allowing in-place decryption without making a private copy. An attacker could exploit this to read or modify ESP data in UDP packets originating from shared pages.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns passing flow_id to the set_rps_cpu() function, which may lead to out-of-bounds access and system crashes.

A race condition was found in the Linux kernel's tcp_v6_syn_recv_sock() function. After tcp_v4_syn_recv_sock() returns, the child socket is already visible in the TCP ehash table, but the pinet6 pointer still points to the listener's structures, potentially causing issues.

In the Linux kernel, a vulnerability was found in netconsole where the message passed from the console subsystem is not guaranteed to be null-terminated, leading to out-of-bounds reads. KASAN reported a slab-out-of-bounds error during message processing.

In the Linux kernel, __ioam6_fill_trace_data() on the IPv6 IOAM receive path fails to validate trace->nodelen against trace->type. A crafted packet can set nodelen=0 while setting type bits 0-21, causing a write of about 100 bytes past the allocated region (into skb_shared_info), corrupting adjacent heap memory and leading to a kernel panic.

In the Linux kernel, the dlm_search_rsb_tree function lacks validation of the len parameter from network messages. When exceeding DLM_RESNAME_MAXLEN, it can cause an out-of-bounds write.