Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled<br /> <br /> The architecture updates the cpu_mask in a domain&amp;#39;s header to track which<br /> online CPUs are associated with the domain. When this mask becomes empty<br /> the architecture initiates offline of the domain that includes calling<br /> on resctrl fs to offline the domain. If it is a monitoring domain in<br /> which LLC occupancy is tracked resctrl fs forces the limbo handler to<br /> clear all busy RMID state associated with the domain.<br /> <br /> The limbo handler always reads the current event value associated with a<br /> busy RMID irrespective of it being checked as part of regular "is it still<br /> busy" check or whether it will be forced released anyway. When reading an<br /> RMID on a system with SNC enabled the "logical RMID" is converted to the<br /> "physical RMID" and this conversion requires the NUMA node ID of the<br /> resctrl monitoring domain that is in turn determined by querying the NUMA<br /> node ID of any CPU belonging to the monitoring domain.<br /> <br /> When the monitoring domain is going offline its cpu_mask is empty causing<br /> the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as<br /> argument resulting in an out-of-bounds access.<br /> <br /> Refactor the limbo handler to skip reading the RMID when the RMID will<br /> just be forced to no longer be dirty in the domain anyway. Add a safety<br /> check to the architecture&amp;#39;s RMID reader to protect against this scenario.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: usb-audio: avoid kobject path lookup in DualSense match<br /> <br /> The DualSense jack-detection input handler verifies that a matching input<br /> device belongs to the same physical controller by building kobject path<br /> strings for both the input device and the USB audio device, then comparing<br /> the path prefix.<br /> <br /> This was observed when a weak physical connection caused the controller<br /> to rapidly disconnect and reconnect. During that repeated hotplug,<br /> snd_dualsense_ih_match() can run while the controller&amp;#39;s USB device is<br /> being disconnected. kobject_get_path() walks ancestor kobjects and<br /> dereferences their names; if the USB device kobject name is no longer<br /> valid, this can fault in strlen():<br /> <br /> RIP: 0010:strlen+0x10/0x30<br /> Call Trace:<br /> kobject_get_path+0x34/0x150<br /> snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]<br /> input_register_device+0x566/0x6a0<br /> ps_probe+0xb89/0x1590 [hid_playstation]<br /> <br /> The same ownership check can be done without building kobject path<br /> strings. The input device is parented below the HID device, USB interface<br /> and USB device, so walking the input device parent chain and comparing<br /> against the mixer USB device preserves the check without dereferencing<br /> kobject names during disconnect.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()<br /> <br /> snd_seq_event_dup() copies an incoming event into a pool cell and, in<br /> the UMP-enabled build, clears the trailing cell-&gt;ump.raw.extra word that<br /> the memcpy() did not cover. The guard deciding whether to clear it<br /> compares the copied size against sizeof(cell-&gt;event):<br /> <br /> memcpy(&amp;cell-&gt;ump, event, size);<br /> if (size event))<br /> cell-&gt;ump.raw.extra = 0;<br /> <br /> For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==<br /> sizeof(cell-&gt;event), so the condition is false and the extra word keeps<br /> stale data. The cell pool is allocated with kvmalloc() (not zeroed) and<br /> cells are reused via a free list, so that word holds uninitialised heap<br /> or leftover event data.<br /> <br /> When such a cell is delivered to a UMP client (client-&gt;midi_version &gt; 0)<br /> that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it<br /> unconverted -- snd_seq_read() reads it out as the larger struct<br /> snd_seq_ump_event and copies the stale word to user space, a 4-byte<br /> kernel heap infoleak to an unprivileged /dev/snd/seq client.<br /> <br /> Compare against sizeof(cell-&gt;ump) instead, so the trailing word is zeroed<br /> for every event shorter than the UMP cell.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: ice1712: check snd_ctl_new1() return value<br /> <br /> snd_ctl_new1() can return NULL when memory allocation fails. The<br /> ice1712 driver calls snd_ctl_new1() without checking the return value<br /> before dereferencing the pointer in multiple places (ice1712.c,<br /> ice1724.c, aureon.c), which can lead to NULL pointer dereferences.<br /> <br /> Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any<br /> fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: gus: check snd_ctl_new1() return value<br /> <br /> snd_ctl_new1() can return NULL when memory allocation fails.<br /> snd_gf1_pcm_volume_control() does not check the return value before<br /> dereferencing kctl-&gt;id.index, which can lead to a NULL pointer<br /> dereference.<br /> <br /> Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: firewire: isight: bound the sample count to the packet payload<br /> <br /> isight_packet() takes the frame count from the device iso packet and<br /> checks it only against the device claimed iso length.<br /> <br /> count = be32_to_cpu(payload-&gt;sample_count);<br /> if (likely(count samples, count);<br /> <br /> length is the iso header data_length. It can be up to 0xffff. So the<br /> gate allows a count up to about 16379. isight_samples() then copies<br /> count frames out of payload-&gt;samples into the PCM DMA buffer.<br /> <br /> payload-&gt;samples holds only 2 * MAX_FRAMES_PER_PACKET values. The<br /> device multiplexes two samples per frame. A count past<br /> MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer<br /> size writes past runtime-&gt;dma_area. The smallest PCM buffer is larger<br /> than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET<br /> keeps both the read and the write in range.<br /> <br /> A malicious or faulty Apple iSight on the FireWire bus reaches this<br /> during a normal capture.<br /> <br /> Add the MAX_FRAMES_PER_PACKET bound to the gate.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: hda/cs35l41: Fix firmware load work teardown<br /> <br /> cs35l41_hda creates ALSA controls whose private data points at the<br /> cs35l41_hda object. The firmware load control can also queue<br /> fw_load_work.<br /> <br /> Those controls are not removed on component unbind, and device remove<br /> only cancels fw_load_work through cs35l41_remove_dsp(). That helper is<br /> skipped when halo_initialized is false. With firmware_autostart<br /> disabled, a firmware load can be requested before the DSP has been<br /> initialized. If the component or device is removed before the queued<br /> work runs, the worker can run after teardown and dereference driver<br /> state that is no longer valid.<br /> <br /> Track the created controls and remove them on unbind so no new control<br /> callback can reach the driver data or queue more work. Then cancel<br /> fw_load_work to drain any request that was already queued. Also cancel<br /> the work unconditionally during device remove before runtime PM teardown.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btusb: fix use-after-free on marvell probe failure<br /> <br /> Make sure to stop any TX URBs submitted during Marvell OOB wakeup<br /> configuration on later probe failures to avoid use-after-free in the<br /> completion callback.<br /> <br /> This issue was reported by Sashiko while reviewing a fix for a wakeup<br /> source leak in the btusb probe errors paths.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btusb: fix use-after-free on registration failure<br /> <br /> Make sure to release the sibling interfaces in case controller<br /> registration fails to avoid use-after-free and double-free when they are<br /> eventually disconnected.<br /> <br /> This issue was reported by Sashiko while reviewing a fix for a wakeup<br /> source leak in the btusb probe errors paths.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/mlx5: Fix racy bitfields and tighten struct layout<br /> <br /> Bitfield operations are not atomic, they use a read-modify-write<br /> pattern, therefore we should be careful not to pack bitfields that<br /> can be concurrently updated into the same storage unit.<br /> <br /> This split takes a binary approach: flags that are only modified<br /> pre/post open/close remain bitfields, flags modified from user<br /> action, including actions that reach across to another device (ex.<br /> reset) use dedicated storage units.<br /> <br /> Note mlx5_vhca_page_tracker.status is relocated to fill the alignment<br /> hole this split exposes.<br /> <br /> Bitfield justifications:<br /> <br /> migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe<br /> chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe<br /> mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe<br /> <br /> Dedicated storage units:<br /> <br /> mdev_detach: written in the VF attach/detach event notifier<br /> mlx5fv_vf_event() at runtime<br /> log_active: written in mlx5vf_start_page_tracker()/<br /> mlx5vf_stop_page_tracker() during runtime dirty tracking<br /> deferred_reset: written in mlx5vf_state_mutex_unlock()/<br /> mlx5vf_pci_aer_reset_done() during runtime reset handling<br /> is_err: set by tracker error handling and dirty-log polling at runtime<br /> object_changed: set by tracker event handling and cleared by dirty-log<br /> polling at runtime

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio: Remove device debugfs before releasing devres<br /> <br /> VFIO device debugfs files created with debugfs_create_devm_seqfile()<br /> store a devres allocated debugfs_devm_entry as inode private data.<br /> vfio_unregister_group_dev() currently calls vfio_device_del() before<br /> vfio_device_debugfs_exit(), but device_del() releases devres. This can<br /> leave debugfs entries visible with stale inode private data while<br /> unregister waits for userspace references to drain.<br /> <br /> Remove the per-device debugfs tree before vfio_device_del(). The debugfs<br /> view is diagnostic only, so losing it at the start of unregister is<br /> preferable to preserving entries whose backing storage may already have<br /> been released.<br /> <br /> Complete the teardown by clearing the per-device debugfs root after<br /> removal. This matches the global debugfs root cleanup and prevents<br /> future users from mistaking a removed dentry for a live debugfs tree<br /> during the remainder of unregister.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc<br /> <br /> vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time,<br /> looping to skip optional states the device does not support until<br /> *next_fsm is supported. A blocked transition is encoded as<br /> VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL.<br /> <br /> The skip loop does not account for the ERROR sentinel.<br /> state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is<br /> ERROR, so once *next_fsm becomes ERROR the loop condition stays true and<br /> *next_fsm never changes. The blocked arcs STOP_COPY -&gt; PRE_COPY and<br /> STOP_COPY -&gt; PRE_COPY_P2P map to ERROR yet pass the support check on a<br /> precopy-capable device, causing the loop to spin forever while holding<br /> the driver state mutex. This can result in a soft lockup, and a panic<br /> with softlockup_panic set.<br /> <br /> Terminate the skip loop on the ERROR sentinel so a blocked transition<br /> falls through to the existing return and reports -EINVAL.