Linux kernel vulnerabilities

A vulnerability was fixed in the Linux kernel's net/smc subsystem where IPPROTO_SMC sockets did not set the icsk_sync_mss pointer despite INET_PROTOSW_ICSK being set. This led to a kernel panic (NULL pointer dereference) during socket creation, e.g., triggered by security modules like Smack.

In the Linux kernel, a vulnerability was resolved in drm/amd/display: system hang while resuming with a TBT monitor. During resume, the Thunderbolt monitor HPD triggered drm_client_modeset_probe() while connector->dev->master was NULL, messing up the pipe topology. The fix skips TBT monitor HPD during resume.

In the Linux kernel, the drm/xe/hdcp component lacks a validity check for the GSC structure. When xe_gsc is not initialized during HDCP capability check, a null pointer error occurs.

In the Linux kernel, the dcn401_init_hw function in the drm/amd/display driver has a potential null pointer dereference. The issue can occur when dc->clk_mgr or dc->clk_mgr->funcs is null. The fix adds a check to ensure these pointers are not null before accessing their functions.

In the Linux kernel, a vulnerability was resolved in drm/amd/display: a NULL check was added for the function pointer in dcn401_set_output_transfer_func. Previously, set_output_gamma was checked for null but then dereferenced without a null check, potentially leading to a null pointer dereference. The fix ensures set_output_gamma is not null before calling it.

In the Linux kernel, a null check for the 'afb' variable was added in amdgpu_dm_update_cursor. Previously, 'afb' was assumed to be null at line 8388 but was used later without a null check, potentially leading to a null pointer dereference.

In the Linux kernel, the drm/amdgpu driver added an empty list check to avoid null pointer issues in some corner cases during list_for_each_entry_safe() iteration.

In the Linux kernel drm/xe driver, user binds map to engines that can fault, and faults depend on user binds completion, which can cause a deadlock. To avoid this, a reserved copy engine is used for user binds on faulting devices.

A vulnerability has been identified in the Linux kernel related to the incorrect definition of the value for AMDGPU_DMUB_NOTIFICATION_MAX, potentially leading to out-of-bounds access in the array.

A vulnerability in the Linux kernel related to a KASAN bug was fixed, which occurred when writing data that was not 4-byte aligned to TX FIFO. This issue could be reproduced by writing 3 bytes of data to a NOR chip.

In the Linux kernel, the hns3 driver has an out-of-bounds array access when looping over tnl_num. The tnl_num value comes from hardware while the array length is fixed, which can lead to reading or writing beyond the array bounds.

In the Linux kernel, the drm/amdgpu/vcn driver removed IRQ disabling calls in the VCN 5 suspend path because VCN IRQ is not directly enabled or disabled in version 5.0.0. The change eliminates the "WARN_ON(!amdgpu_irq_enabled(adev, src, type))" warning in amdgpu_irq_put().

In the Linux kernel, the maximum size of a subrequest that writes to cachefiles was set to MAX_RW_COUNT to prevent overrunning the maximum write to the backing filesystem.

In the Linux kernel, the SMB server fixed a potential null pointer dereference in smb2_open() that occurred when the oplock level was SMB2_OPLOCK_LEVEL_LEASE and parse_lease_state() returned NULL. The fix checks whether lease_ctx_info is NULL.

In the Linux kernel, a vulnerability was resolved in the idpf driver involving memory leaks and crashes during a soft reset. The reset allocated a new queue set with a temporary vport structure, leading to use-after-free, double memory allocation, and leaks, and leaving the interface in an inconsistent state. The fix avoids allocating a new queue set during reset and restores the old queue number and reopens the interface on rollback.

In the Linux kernel, the idpf driver has a use-after-free issue when destroying queues. The driver frees interrupt vectors with embedded NAPIs before freeing the queues, causing page_pool NAPI pointers to reference freed memory. The fix inverts allocation and freeing logic so vectors are allocated first and freed last.

In the Linux kernel, a vulnerability was resolved in BPF: a crash due to out-of-bounds access into reg2btf_ids was fixed. Commit e6ac2450d6de added kfunc support and defined reg2btf_ids to translate verifier reg type to BTF ID. Commit c25b2ae13603 moved __BPF_REG_TYPE_MAX, causing direct usage of reg->type to index reg2btf_ids to potentially fall out of range, leading to out-of-bounds access and kernel crash.

In the Linux kernel, the wifi rtw89 driver (WoW - Wake on Wireless feature) has a bug where an oversized skb is placed, exceeding skb->end and causing a kernel panic (skb_over_panic) during system resume from sleep. The vulnerability has been fixed.

In the Linux kernel, a vulnerability was fixed in the rtw89 wifi driver where scan offload attempted to use all 6 GHz channels even when the 6 GHz sband was NULL (e.g., blocked by BIOS). NULL handling was added to avoid a crash.

In the Linux kernel block subsystem, blkcg_init_queue() may add rq qos structures to a request queue, but blk_cleanup_queue() does not release them when the queue has no disk (e.g., un-present SCSI LUNs, NVMe admin queue). This causes a memory leak.

In the Linux kernel, the ACPI CPPC (Collaborative Processor Performance Control) implementation incorrectly used bit_width instead of access_width to determine the size of system memory accesses. Since bit_width can be any 8-bit value and is not always aligned to an 8-bit boundary, this caused invalid memory accesses, leading to an asynchronous SError interrupt and kernel panic on the Cobalt 100 platform during cppc_cpufreq driver initialization.

A null pointer dereference flaw exists in the Linux kernel cryptographic scatterwalk API. It occurs when a user constructs a malicious packet with a specific socket configuration, potentially allowing a local user to crash the system or escalate privileges.

A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel Samba server and CIFS in the Linux kernel. An attacker could crash the system by accessing freed work.

A deadlock flaw was found in the Linux kernel's BPF subsystem. This flaw allows a local user to potentially crash the system.

An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function called from an invalid context in gsmld_write, which will block the kernel. Note: This has been disputed by 3rd parties as not a valid vulnerability.

A use-after-free flaw was found in the Linux kernel's nouveau driver. A user can trigger a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash the system or potentially escalate privileges.

The afu_mmio_region_get_by_offset function in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.

A flaw named "EntryBleed" exists in the Linux kernel Page Table Isolation (KPTI). It could allow a local attacker to leak the KASLR base via prefetch side-channels based on TLB timing on Intel systems.

A double-free flaw exists in the Linux kernel's NTFS3 subsystem when a user triggers remount and umount simultaneously. This can crash the system or potentially escalate privileges.

In the Linux kernel, a race condition exists in rose_connect(). The rose driver uses rose_neigh->use to track usage, and when deleting a route via rose_ioctl() it removes neighbours only if their 'count' and 'use' are zero, which can lead to inconsistency.

A use-after-free flaw was found in the Linux kernel's PLP Rose functionality when a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.

An out-of-bounds read vulnerability was discovered in the Linux kernel SMC protocol stack, allowing remote denial of service.

A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed their descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID and real GID equal to effective GID; the descendant then has dumpable set to 1. If the descendant crashes and core_pattern is relative, its core dump is stored in the current directory with uid:gid permissions.

A flaw was found in the Linux kernel's memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism; the same technique can be used if an attacker can upload page-sized files and detect access time changes from a networked service to determine if a page has been merged.

A null pointer dereference flaw was found in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 when rebooting the system. A local user could use this flaw to crash the system or escalate their privileges.

Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patches change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.

The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, allowing local users to cause a denial of service (memory consumption and system hang) by leveraging root access to execute crafted applications.

The check_stack_boundary function in the Linux kernel through version 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by mishandling invalid variable stack read operations.

The Linux kernel through version 4.14.8 contains a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact due to the lack of stack-pointer alignment enforcement.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by improperly using pointers instead of scalars.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service through integer overflow and memory corruption by leveraging unrestricted integer values for pointer arithmetic.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by mishandling register truncation.

The raw_sendmsg() function in the Linux kernel through version 4.14.6 has a race condition in inet->hdrincl, leading to uninitialized stack pointer usage. This allows a local user to execute code and gain privileges.

The Linux Kernel 2.6.32 and later are affected by a denial of service. Flooding the diagnostic port 0x80 can trigger an exception leading to a kernel panic.

The Linux kernel version 3.3-rc1 and later is affected by a vulnerability related to the processing of incoming L2CAP commands - ConfigRequest and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state.

The bnep_add_connection function in the Linux kernel before version 3.19 does not ensure that an l2cap socket is available, allowing local users to gain privileges via a crafted application.

The dccp_disconnect function in the Linux kernel through version 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.