Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> audit: fix recursive locking deadlock in audit_dupe_exe()<br /> <br /> A deadlock occurs in the audit subsystem when duplicating<br /> executable-related rules.<br /> <br /> When a file is moved (e.g., via do_renameat2()), the VFS layer locks<br /> the parent directory (I_MUTEX_PARENT), which synchronously triggers an<br /> fsnotify_move event. If an existing executable audit rule matches the<br /> file being moved, the audit subsystem catches this event and calls<br /> audit_dupe_exe() to duplicate the watch and update the rule. Then,<br /> audit_alloc_mark() would call kern_path_parent() to resolve the path,<br /> leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock<br /> already held by the task, resulting in the following recursive locking<br /> deadlock:<br /> <br /> ============================================<br /> WARNING: possible recursive locking detected<br /> 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted<br /> --------------------------------------------<br /> mv/5099 is trying to acquire lock:<br /> ffff888132845358 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1){+.+.}-{3:3},<br /> at: __kern_path_locked+0x10a/0x2f0<br /> <br /> but task is already holding lock:<br /> ffff888132846b58 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1){+.+.}-{3:3},<br /> at: lock_two_directories+0x13f/0x2b0<br /> <br /> other info that might help us debug this:<br /> Possible unsafe locking scenario:<br /> <br /> CPU0<br /> ----<br /> lock(&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1);<br /> lock(&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1);<br /> <br /> *** DEADLOCK ***<br /> <br /> May be due to missing lock nesting notation<br /> <br /> 6 locks held by mv/5099:<br /> #0: ffff888112a9c440 (sb_writers#13)<br /> at: do_renameat2+0x34c/0xbc0<br /> #1: ffff888112a9c790 (&amp;type-&gt;s_vfs_rename_key#3)<br /> at: do_renameat2+0x415/0xbc0<br /> #2: ffff888132846b58 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1)<br /> at: lock_two_directories+0x13f/0x2b0<br /> #3: ffff888132845358 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/5)<br /> at: lock_two_directories+0x175/0x2b0<br /> #4: ffffffffb3a1fb10 (&amp;fsnotify_mark_srcu)<br /> at: fsnotify+0x454/0x28a0<br /> #5: ffffffffaf886230 (audit_filter_mutex)<br /> at: audit_update_watch+0x36/0x11e0<br /> <br /> stack backtrace:<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x6f/0xb0<br /> print_deadlock_bug.cold+0xbd/0xca<br /> validate_chain+0x83a/0xf00<br /> __lock_acquire+0xcac/0x1d20<br /> lock_acquire.part.0+0x11b/0x360<br /> down_write_nested+0x9f/0x230<br /> __kern_path_locked+0x10a/0x2f0<br /> kern_path_locked+0x26/0x40<br /> audit_alloc_mark+0xfb/0x4f0<br /> audit_dupe_exe+0x6c/0xe0<br /> audit_dupe_rule+0x6c2/0xc00<br /> audit_update_watch+0x4cc/0x11e0<br /> audit_watch_handle_event+0x12c/0x1b0<br /> send_to_group+0x5d0/0x8b0<br /> fsnotify+0x615/0x28a0<br /> fsnotify_move+0x1d8/0x630<br /> vfs_rename+0xdcd/0x1df0<br /> do_renameat2+0x9d4/0xbc0<br /> __x64_sys_renameat+0x192/0x260<br /> do_syscall_64+0x92/0x180<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7f0491fe8c4e<br /> Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff<br /> c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <br /> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89<br /> RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108<br /> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e<br /> RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001<br /> R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a<br /> R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c<br /> <br /> <br /> The aforementioned deadlock can be consistently reproduced by running<br /> the script below:<br /> <br /> audit-dupe-exe-deadlock.sh<br /> --------------------------<br /> #!/bin/bash<br /> auditctl -D<br /> mkdir -p /tmp/foo<br /> touch /tmp/file<br /> auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr<br /> mv /tmp/file /tmp/foo/file<br /> rm -Rf /tmp/foo<br /> <br /> This patch fixes the issue by introducing struct audit_watch_ctx to pass<br /> the fsnotify event context down to audit_alloc_mark(). By utilizing the<br /> already-resolved directory inode provided by the event, we bypass the<br /> kern_path_parent() path resol<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug<br /> <br /> If a vCPU stays scheduled out (or blocked) while the last pCPU it ran<br /> on goes through a hotplug cycle (online-&gt;offline-&gt;online), and the vCPU<br /> then resumes execution on the same pCPU, then it is possible for it to<br /> run with an ASID that has now been assigned to a different vCPU,<br /> resulting in stale TLB translations being used.<br /> <br /> svm_enable_virtualization_cpu() resets asid_generation to 1 and sets<br /> next_asid to max_asid + 1 on every CPU online event, including hotplug<br /> cycles. Because next_asid starts beyond the pool boundary, the first<br /> call to new_asid() after an online event always wraps the pool,<br /> incrementing asid_generation to 2 and assigning ASIDs starting from<br /> min_asid.<br /> <br /> Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding<br /> asid_generation=2 and ASID=N from before the hotplug event:<br /> <br /> 1. CPU-X goes offline and back online: asid_generation resets to 1,<br /> next_asid = max_asid + 1.<br /> <br /> 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping<br /> the pool and consuming ASIDs starting from min_asid. Eventually<br /> vCPU-B from a different VM is assigned asid_generation=2, ASID=N<br /> — the same ASID that vCPU-A held before the hotplug.<br /> <br /> 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-&gt;cpu is<br /> unchanged so the migration branch is skipped. Its saved<br /> asid_generation=2 matches sd-&gt;asid_generation=2, so the generation<br /> check silently passes and vCPU-A continues running with ASID=N —<br /> the same ASID just freshly assigned to vCPU-B.<br /> <br /> Both vCPUs from different VMs now run on CPU-X with the same ASID,<br /> causing them to share NPT TLB entries and producing stale translations.<br /> <br /> The collision manifests as a KVM internal error (Suberror: 1, emulation<br /> failure). The NPT page fault reports a faulting GPA far outside the<br /> VM&amp;#39;s physical memory range — a sign of stale TLB translations being<br /> used. KVM falls back to instruction emulation, which fails on<br /> FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not<br /> implement.<br /> <br /> Fix this by incrementing asid_generation instead of resetting it to 1<br /> in svm_enable_virtualization_cpu(). On module load, asid_generation<br /> starts at 0 (memset) and the increment produces 1, identical to the<br /> old behaviour. On subsequent hotplug cycles the generation advances<br /> beyond any value a vCPU previously observed on this CPU, so the<br /> generation check in pre_svm_run() reliably forces new_asid() on every<br /> vCPU after every hotplug cycle.

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

A flaw was found in GIMP&amp;#39;s PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim&amp;#39;s system.

entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service. <br /> <br /> <br /> This issue was fixed in commit 2467fe0

A flaw was found in StackRox/RHACS Central&amp;#39;s Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Improper neutralization of special elements used in an OS command (&amp;#39;OS command injection&amp;#39;) vulnerability in Zyxel Networks WAH7601 allows OS Command Injection.<br /> <br /> This issue affects WAH7601: through 20072026.

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data.<br /> <br /> This issue affects WAH7601: through 20072026.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> time/jiffies: Register jiffies clocksource before usage<br /> <br /> Teddy reported that a XEN HVM has a long boot delay, which was bisected to<br /> the recent enhancements to the negative motion detection. It turned out<br /> that the jiffies clocksource is used in early boot before it is registered,<br /> which leaves the max_delta_raw field at zero. That causes the read out to<br /> be clamped to the max delta of 0, which means time is not making progress.<br /> <br /> Cure it by ensuring that it is initialized before its first usage in<br /> timekeeping_init().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/khugepaged: write all dirty file folios when collapsing<br /> <br /> [There is no upstream commit, as this code was removed by upstream<br /> commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")]<br /> <br /> As-is, khugepaged and writable-file opening exclude each other. A file<br /> cannot be open writeable and have THPs (because the filesystem is not aware<br /> of them). khugepaged will never collapse file pages for files that are<br /> opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that<br /> particular file is dropped. This is fine because nothing could&amp;#39;ve been<br /> dirtied.<br /> <br /> However, there is an edge-case: collapse_file() might not be able to<br /> coexist with concurrent writers, but it can coexist with dirty folios<br /> (from previous writers). Therefore, the following can happen:<br /> <br /> open(file, O_RDWR)<br /> write(file)<br /> close(file)<br /> madvise(file_mapping, MADV_COLLAPSE, some non-dirty range)<br /> open(file, O_RDWR)<br /> nr_thps &gt; 0<br /> truncate_inode_pages()<br /> /* THPs are cleared out, but so are the dirty folios */<br /> <br /> When this edge-case happens, there is data loss, as the dirty folios are<br /> fully discarded.<br /> <br /> Fix it by fully writing back the page cache (and waiting) when collapsing<br /> file THPs. Doing so provides the guarantee that no dirty folio will be<br /> observed while there are active THPs. To fully ensure this is safe, the<br /> invalidate_lock needs to be held while doing the writeout, so that<br /> do_dentry_open()&amp;#39;s page cache truncation excludes this write-and-wait.<br /> <br /> As a side effect, move the nr_thps counter bumping outside the i_pages<br /> lock. This is correct since the counter itself is an atomic_t and the<br /> producer consumer correctness is provided by a full memory barrier:<br /> smp_mb() in collapse_file()/memory barrier implied by full ordering in<br /> get_write_access() -&gt; atomic_inc_unless_negative().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled<br /> <br /> HCI_UART_SENDING bit in tx_state means write_work is pending and blocks<br /> queueing it again. Currently this bit is not cleared when canceling the<br /> work in hci_uart_close(), which blocks future writes when device is<br /> reopened later if write_work was pending.<br /> <br /> Fix by clearing HCI_UART_SENDING when canceling the work.<br /> <br /> Also make clearing of tx_skb safe by using disable_work_sync +<br /> enable_work instead of just cancel_work_sync. hci_uart_flush() purges<br /> the proto tx queue so we can cancel the pending write_work there,<br /> instead of doing it just in hci_uart_close(). Re-enable and possibly<br /> requeue the work after queue flush.