Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: gw: acquire ethernet header only after skb realloc<br /> <br /> The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer<br /> behind the skb. Variables which were pointing to the old buffer need to be<br /> reassigned to avoid an use-after-free.

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.

The User Registration &amp; Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user&amp;#39;s in-progress email change, including an administrator&amp;#39;s.

The User Registration &amp; Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration &amp; Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.

SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> inet: frags: strip GSO state from fragments before reassembly<br /> <br /> A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark<br /> an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.<br /> inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first<br /> fragment&amp;#39;s skb as the head of the reassembled datagram, including its<br /> shinfo-&gt;gso_size/gso_type/gso_segs, and chain the remaining fragments<br /> on frag_list with whatever linear/paged layout they arrived with.<br /> <br /> After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the<br /> reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and<br /> the next software segmentation point - udp_rcv_segment() on local<br /> delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow<br /> path - hands it to skb_segment(). skb_segment()&amp;#39;s frag_list walk<br /> assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to<br /> a tap by an unprivileged user in its own userns are enough:<br /> <br /> kernel BUG at net/core/skbuff.c:4899!<br /> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI<br /> CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2<br /> RIP: 0010:skb_segment+0x20ca/0x48b0<br /> Call Trace:<br /> <br /> __udp_gso_segment+0x29a/0x27d0<br /> udp4_ufo_fragment+0x458/0x6c0<br /> inet_gso_segment+0x429/0x1340<br /> skb_mac_gso_segment+0x233/0x4f0<br /> __skb_gso_segment+0x308/0x660<br /> udp_queue_rcv_skb+0x440/0xad0<br /> udp_unicast_rcv_skb+0xc7/0x2c0<br /> udp_rcv+0x16ce/0x2260<br /> ip_protocol_deliver_rcu+0x197/0x2d0<br /> ip_local_deliver+0x430/0x690<br /> ip_rcv+0x16f/0x1f0<br /> __netif_receive_skb_one_core+0x15e/0x1c0<br /> __netif_receive_skb+0x1e/0x110<br /> netif_receive_skb+0xf6/0x5c0<br /> tun_rx_batched.isra.0+0x3ab/0x790<br /> tun_get_user+0x17c3/0x3550<br /> tun_chr_write_iter+0xba/0x1b0<br /> vfs_write+0x646/0x1130<br /> <br /> Kernel panic - not syncing: Fatal exception in interrupt<br /> <br /> This runs with BH disabled, so it is a panic rather than an oops. The<br /> same is reachable with CAP_NET_RAW in a netns where a defrag point<br /> precedes a GSO point, and from a guest whose VMM forwards<br /> virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by<br /> commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting<br /> gso_size mangled skb having linear-headed frag_list") and by<br /> commit 9e4b7a99a03a ("net: gso: fix panic on frag_list with mixed head<br /> alloc types") do not cover it: page-backed heads skip them, and kmalloc<br /> heads skip them when gso_size == skb_headlen(head), which the sender<br /> controls.<br /> <br /> An skb entering a frag queue is an IP fragment by definition and<br /> cannot legitimately carry GSO state: GRO does not merge fragments and<br /> the stack segments before it fragments, so only untrusted sources are<br /> affected. This has been reachable since<br /> commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), the first<br /> path that let userspace attach GSO metadata to an IP fragment. Reset<br /> the GSO fields of every fragment as it is queued, in<br /> inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and<br /> 6lowpan reassembly share; then neither the head nor the frag_list<br /> members of the reassembled skb carry them (the members matter too:<br /> the ip_do_fragment()/ip6_fragment() fast paths send them out as they<br /> are). The head may remain CHECKSUM_PARTIAL; that is already accepted<br /> on receive and resolved by skb_checksum_help() in<br /> ip_do_fragment()/ip6_fragment() on forward.<br /> <br /> Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer<br /> above, two further IPv4 frag_list geometries that reach<br /> BUG_ON(i &gt;= nfrags) and BUG_ON(!list_skb-&gt;head_frag), and an IPv6<br /> fragment-header variant (udp6_ufo_fragment()) each panic the unpatched<br /> kernel; with this patch all four datagrams are delivered intact and<br /> nothing is logged.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix listxattr handling of corrupted xattr entries<br /> <br /> Validate the xattr entry before reading its fields in f2fs_listxattr().<br /> Return -EFSCORRUPTED when the entry is outside the valid xattr storage<br /> area instead of returning a successful partial result.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> samples/damon/mtier: fail early if address range parameters are invalid<br /> <br /> The comment on top of `struct damon_region` clearly says that<br /> <br /> For any use case, @ar should be non-zero positive size.<br /> <br /> which is now verified in damon_verify_new_region() if the kernel is built<br /> with DAMON_DEBUG_SANITY.<br /> <br /> The WARN_ONCE() can be triggered if the mtier sample module is enabled<br /> before node{0,1}_{start,end}_addr have been properly initialized, which is<br /> obviously not good.<br /> <br /> ------------[ cut here ]------------<br /> start 0 &gt;= end 0<br /> WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468<br /> Call trace:<br /> damon_new_region+0xf4/0x118 (P)<br /> damon_set_regions+0xfc/0x3c0<br /> damon_sample_mtier_build_ctx+0xe8/0x3a8<br /> damon_sample_mtier_start+0x1c/0x90<br /> damon_sample_mtier_enable_store+0x98/0xb0<br /> param_attr_store+0xb4/0x128<br /> module_attr_store+0x2c/0x50<br /> sysfs_kf_write+0x58/0x90<br /> kernfs_fop_write_iter+0x16c/0x238<br /> vfs_write+0x2c0/0x370<br /> ksys_write+0x74/0x118<br /> __arm64_sys_write+0x24/0x38<br /> invoke_syscall+0xa8/0x118<br /> el0_svc_common.constprop.0+0x48/0xf0<br /> do_el0_svc+0x24/0x38<br /> el0_svc+0x54/0x370<br /> el0t_64_sync_handler+0xa0/0xe8<br /> el0t_64_sync+0x1ac/0x1b0<br /> ---[ end trace 0000000000000000 ]---<br /> <br /> Note that the same issue can happen if detect_node_addresses is true, and<br /> node 0 or 1 is memoryless. Fix it together by checking the validity of<br /> parameters right before damon_new_region() and fail early if they&amp;#39;re<br /> invalid.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (asus_atk0110) Check package count before accessing element<br /> <br /> atk_ec_present() walks the management group package returned by the GGRP<br /> ACPI method and, for each sub-package, reads its first element:<br /> <br /> id = &amp;obj-&gt;package.elements[0];<br /> if (id-&gt;type != ACPI_TYPE_INTEGER)<br /> <br /> without checking that the sub-package is non-empty. ACPICA allocates the<br /> element array with exactly package.count entries, so for a sub-package<br /> with a zero count this reads past the allocation.<br /> <br /> The sibling function atk_debugfs_ggrp_open() performs the same access but<br /> skips empty packages with a package.count check first. Add the same<br /> check to atk_ec_present() so a malformed firmware package cannot trigger<br /> an out-of-bounds read.

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitize_text_field() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a FullCalendar eventContent callback interpolates customer names directly into JavaScript template literals (redesign/dist/index.js line 199) and renders them via innerHTML without proper HTML entity encoding. Because double quotes are preserved, an attacker can inject payloads like &amp;#39;" onmouseover="alert(document.cookie)"&amp;#39; to break out of the title attribute and inject malicious event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator accesses the Calendar page and hovers over the malicious appointment.