Linux kernel vulnerabilities

In the Linux kernel, the RDMA/srp subsystem has an issue where srp_abort() calls scsi_done(), which can lead to use-after-free. The fix removes this call, keeping the srp_free_req() call before returning SUCCESS.

In the Linux kernel, a race condition between session lookup and expiration in ksmbd can lead to a use-after-free. The fix adds an rwsem to synchronize these operations.

In the Linux kernel, the UDP module has a vulnerability where L4 aggregation is incorrectly applied to UDP tunnel packets. When GRO options are enabled, it can corrupt inner protocols, e.g., ignoring different VXLAN IDs.

In the Linux kernel, a use-after-free vulnerability in the emac_mac_tx_buf_send function of the EMAC network driver has been fixed. The issue is that after the skb is freed in case of an error in emac_tx_fill_tpd(), the skb is still used via skb->len by netdev_sent_queue(), leading to a use-after-free.

A vulnerability in the Linux kernel's SCTP protocol leads to a use-after-free of a transport structure. The issue occurs when processing a duplicate COOKIE-ECHO chunk in sctp_sf_do_dupcook_a(), where COOKIE-ACK and SHUTDOWN chunks are allocated with the new association but later used by the old one, potentially causing a system panic.

In the Linux kernel, the ch_ktls module has an issue causing kernel panic. Taking page refcount is not ideal and can lead to panic; it's better to take tx_ctx lock for the complete skb transmit to avoid page cleanup during transmission.

In the Linux kernel, the netlabel module has two out-of-bounds array accesses: one in cipso_v4_map_lvl_valid() and the other in netlbl_bitmap_walk(). The fixes are straightforward and involve bounds checking.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup. If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid.

In the Linux kernel, a use-after-free vulnerability in the ksmbd_tcp_new_connection() function of the ksmbd module has been fixed. The issue is caused by a race between handling a new TCP connection and its disconnection, leading to a use-after-free on the tcp_transport structure.

In the Linux kernel, in the tls module, there is a vulnerability due to a race between tx work scheduling and socket close. The submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). The fix reorders scheduling the work before calling complete().

In the Linux kernel, a TLS module issue was fixed regarding the handling of crypto requests that may be backlogged. When the CRYPTO_TFM_REQ_MAY_BACKLOG flag is set, crypto_aead functions can return -EBUSY instead of -EINPROGRESS, causing the async callback to be invoked twice. The fix converts -EBUSY to -EINPROGRESS to avoid modifying error handling paths.

In the Linux kernel, there is a race condition in the TLS implementation between async notify and socket close. The submitting thread may exit as soon as the async crypto handler calls complete(), risking access to already freed data.

Use-after-free vulnerability in the Linux kernel's TLS implementation with partial reads and async decrypt. tls_decrypt_sg does not take a reference on pages from clear_skb, so put_page() in tls_decrypt_done releases them, leading to use-after-free in process_rx_list.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request. smb2_get_msg() in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if SMB2_TREE_CONNECT_HE is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

In the Linux kernel, the ksmbd module has an out-of-bounds access in init_smb2_rsp_hdr(). If a client sends an SMB2 negotiate request and then an SMB1 negotiate request, the function is called for the SMB1 request, leading to an issue. The fix ignores SMB1 packets after need_neg is set to false.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob(). If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.

An issue was discovered in the Linux kernel before version 6.3.4 related to an out-of-bounds read in smb2_find_context_vals. This occurs when the name_len of create_context is larger than the tag length.

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.

An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

A memory leak in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small perturb table size may allow an attacker to leak information and cause a denial of service.

A vulnerability in nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

A type confusion bug in nft_set_elem_init in the Linux kernel up to 5.18.9 leads to a buffer overflow, allowing a local attacker to escalate privileges. The attacker needs an unprivileged user namespace to get CAP_NET_ADMIN access. The fix is in nft_setelem_parse_data.

A heap buffer overflow in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c allows a local attacker with normal privileges to overwrite kernel heap objects, potentially leading to local privilege escalation.

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization.

The __skb_flow_dissect function in the Linux kernel before version 4.3 does not ensure initialization of n_proto, ip_proto, and thoff, allowing remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.

The ip6gre_err function in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, leading to out-of-bounds access.

A use-after-free vulnerability in the kvm_ioctl_create_device function in the Linux kernel before version 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.

The sctp_sf_ootb function in the Linux kernel before version 4.8.8 lacks chunk-length checking for the first chunk, allowing remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.

A use-after-free vulnerability in the __sys_recvmmsg function in the Linux kernel before version 4.5.2 allows remote attackers to execute arbitrary code via mishandled error processing during a recvmmsg system call.

The usbip_recv_xbuff function in the Linux kernel before version 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.

The nf_nat_redirect_ipv4 function in the Linux kernel before version 4.4 allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to system crashes. This issue is related to CVE-2003-1604.

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.

SCTP conntrack (ip_conntrack_proto_sctp.c) in netfilter for Linux kernel 2.6.17 before 2.6.17.3 and 2.6.16 before 2.6.16.23 allows remote attackers to cause a denial of service (crash) via a packet without any chunks, which causes a variable to contain an invalid value that is later used to dereference a pointer.

CVE-1999-0804 vulnerability affects Linux 2.2.x kernels, where malformed ICMP packets with unusual types, codes, and IP header lengths can lead to denial of service.