Vulnerabilidades

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain tcf_action_exec() gestiona TC_ACT_GOTO_CHAIN comprobando primero rcu_access_pointer(a->goto_chain) y llamando después a tcf_action_goto_chain_exec(), que realiza una segunda lectura…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumera tanto struct tc_u_hnode como struct tc_u_knode a través de la función de retorno del recorrido. u32_bind_class() convierte incondicionalmente el fh pasado a tc_u_knode y accede…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: regmap: sdw-mbq: don't call an unset readable_reg callback regmap_sdw_mbq_poll_busy() decide si sondear el bit Function Busy llamando a ctx->readable_reg(), que es una copia directa de config->readable_reg. Esa función de retorno es opcional:…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG En la ruta de recepción de paquetes, el ID del puerto MAC en el que se recibió el paquete está incrustado en los metadatos del descriptor DMA de RX. El ID se extrae mediante la…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtenía un programa SCHED_CLS mediante bpf_prog_get_type_dev(), pero nunca verificaba que el netdev vinculado de un programa vinculado a dispositivo…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firewire: ohci: fix NULL pointer dereference in ar_context_release Durante la ruta de gestión de errores de la función de sondeo del controlador, puede producirse una desreferencia de puntero nulo en ar_context_release(). Cuando pci_probe() falla…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng informó de que el GC podía liberar parcialmente un SCC muerto. El escenario es el siguiente: En 2-1), hay una pequeña ventana en la que unix_add_edges() publica una nueva arista (B <-> B) para el…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: macvlan: inherit needed_headroom and needed_tailroom from lowerdev Los dispositivos macvlan heredan hard_header_len de lowerdev durante macvlan_init(), pero dejan needed_headroom y needed_tailroom establecidos en 0. Cuando el lowerdev subyacente…

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: l2tp: fix tunnel and session refcount leak on seq_file release En pppol2tp_proc_open() y l2tp_dfs_seq_open(), el estado de iteración (pd->tunnel y pd->session) se guarda en los datos privados de seq_file para permitir la iteración a lo largo de varias…

Se ha encontrado un fallo en el plugin file-xwd de GIMP. Al procesar un archivo de imagen XWD especialmente manipulado, el plugin valida los parámetros de anchura de la imagen y de bytes por línea de forma independiente, en lugar de asegurarse de que sus valores combinados sean coherentes con el tamaño del búfer…

Se ha detectado un fallo en el plugin file-pix (ESM) de GIMP. Al procesar un archivo de imagen PIX especialmente diseñado, el plugin reserva una matriz de longitud variable (VLA) en la pila sin una comprobación de límites adecuada, lo que provoca una reserva ilimitada en la pila seguida de una lectura excesiva de 21…

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function…

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs the full…

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object…

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing…

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code falls through to the folio_put path which calls virt_to_folio(NULL), dereferencing an invalid address and…

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (which only takes a refcount) and the subsequent…

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window…

In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that…

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is…

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: [CAUSE] For an inline lzo compressed file extent, there should always be…

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfs_do_encoded_write() Local fuzzing of 6.12.94 has found the following memory leak: Fix this by freeing an extent changeset before returning from btrfs_do_encoded_write().

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxdna_gem_obj_mmap() registers an HMM…

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer…

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking…