Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()<br /> <br /> wacom_wac_queue_flush() is called via the .raw_event callback<br /> (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush).<br /> For USB HID devices, this callback is invoked from hid_irq_in(), which<br /> is a URB completion handler running in atomic context. Using GFP_KERNEL<br /> in this path can sleep, leading to a "scheduling while atomic" bug.<br /> <br /> Use GFP_ATOMIC instead. The existing code already handles allocation<br /> failure by skipping the fifo entry and continuing.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: function: rndis: add length check to response query<br /> <br /> Add variable representations for BufLength and BufOffset in<br /> rndis_query_response(), and perform a length check on them.<br /> <br /> This is identical to how rndis_set_response() handles these parameters.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: core: fix uninitialized data in debugfs<br /> <br /> If *ppos is non-zero then simple_write_to_buffer() will not initialize<br /> the start of buf[]. Non zero values for *ppos aren&amp;#39;t going to work<br /> anyway. Test for them at the start of the function and return -EINVAL.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> debugobjects: Plug race against a concurrent OOM disable<br /> <br /> syzbot reported a puzzling splat:<br /> <br /> WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20<br /> <br /> stub_timer() is installed as timer callback function in<br /> hrtimer_fixup_assert_init(), which is invoked when<br /> debug_object_assert_init() can&amp;#39;t find a shadow object. In that case debug<br /> objects emits a warning about it before invoking the fixup.<br /> <br /> Though the provided console log lacks this warning and instead has the<br /> following a few seconds before the splat:<br /> <br /> ODEBUG: Out of memory. ODEBUG disabled<br /> <br /> So the object was looked up in debug_object_assert_init() and the lookup<br /> failed due a concurrent out of memory situation which disabled debug<br /> objects and freed the shadow objects:<br /> <br /> debug_object_assert_init()<br /> if (!debug_objects_enabled)<br /> return; obj = alloc();<br /> if (!obj) {<br /> // Out of memory<br /> debug_objects_enabled = false;<br /> free_objects();<br /> obj = lookup_or_alloc();<br /> <br /> // The lookup failed because the other side<br /> // removed the objects, so this returns<br /> // an error code as the object in question<br /> // is not statically initialized<br /> <br /> if (!IS_ERR_OR_NULL(obj))<br /> return;<br /> if (!obj) {<br /> debug_oom();<br /> return;<br /> }<br /> <br /> print(...)<br /> if (!debug_objects_enabled)<br /> return;<br /> <br /> fixup(...)<br /> <br /> The debug object splat is skipped because debug_objects_enabled is false,<br /> but the fixup callback is invoked unconditionally, which makes the timer<br /> disfunctional.<br /> <br /> This is only a problem in debug_object_assert_init() and<br /> debug_object_activate() as both have to handle statically initialized<br /> objects and therefore must handle the error pointer return case<br /> gracefully. All other places only handle the found/not found case and the<br /> NULL pointer return is a signal for OOM. Otherwise they get a valid shadow<br /> object.<br /> <br /> Plug the hole by checking whether debug objects are still enabled before<br /> invoking the print and fixup function in those two places.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: wacom: stop hardware after post-start probe failures<br /> <br /> wacom_parse_and_register() starts HID hardware before registering inputs<br /> and initializing pad LEDs/remotes. Those later steps can fail, but their<br /> error paths currently release Wacom resources without stopping the HID<br /> hardware.<br /> <br /> Route post-hid_hw_start() failures through hid_hw_stop() before<br /> releasing driver resources.<br /> <br /> This issue was identified during our ongoing static-analysis research while<br /> reviewing kernel code.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix path resolution in ksmbd_vfs_kern_path_create<br /> <br /> The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the<br /> create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an<br /> absolute path with convert_to_unix_name() and resolves it from AT_FDCWD<br /> via start_creating_path(), so a ".." component is walked from the real<br /> filesystem root and escapes the export.<br /> <br /> An authenticated client races a missing path component so the rooted open<br /> lookup returns -ENOENT (taking the create branch) while the same component<br /> is present (a directory) when the create walk runs; the create then<br /> resolves ".." out of the share.<br /> <br /> Root the create walk at the share like the lookup and rename paths already<br /> are: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH,<br /> &amp;share_conf-&gt;vfs_path) and create the final component with<br /> start_creating_noperm(). convert_to_unix_name() then has no callers and is<br /> removed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: vme_user: fix location monitor leak in tsi148 bridge<br /> <br /> tsi148_probe() allocates a location monitor resource and links it into<br /> tsi148_bridge-&gt;lm_resources. The probe error path frees this list, but<br /> tsi148_remove() only frees the dma, slave and master resource lists, so<br /> the location monitor resource is leaked on device unbind or module<br /> unload.<br /> <br /> Free the lm_resources list in tsi148_remove() as well, before<br /> tsi148_bridge is freed.

URL Redirection to Untrusted Site (&amp;#39;Open Redirect&amp;#39;) vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim&amp;#39;s browser to an origin of the attacker&amp;#39;s choosing via a :to value containing ASCII tab, LF or CR.<br /> <br /> redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as //example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added.<br /> <br /> This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.