Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/pkey: Check length in PKEY_VERIFYPROTK ioctl<br /> <br /> Explicitly check the buffer length request structure provided by<br /> user-space and fail, if it exceeds the buffer size.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> posix-cpu-timers: Prevent UAF caused by non-leader exec() race<br /> <br /> Wongi and Jungwoo decoded and reported a non-leader exec() related race<br /> which can result in an UAF:<br /> <br /> sys_timer_delete() exec()<br /> posix_cpu_timer_del()<br /> // Observes old leader<br /> p = pid_task(pid, pid_type); de_thread()<br /> switch_leader();<br /> release_task(old_leader)<br /> __exit_signal(old_leader)<br /> sighand = lock(old_leader, sighand);<br /> posix_cpu_timers*_exit();<br /> sighand = lock_task_sighand(p) unhash_task(old_leader);<br /> sh = lock(p, sighand) old_leader-&gt;sighand = NULL;<br /> unlock(sighand);<br /> (p-&gt;sighand == NULL)<br /> unlock(sh)<br /> return NULL;<br /> <br /> // Returns without action<br /> if(!sighand)<br /> return 0;<br /> free_posix_timer();<br /> <br /> This is "harmless" unless the deleted timer was armed and enqueued in<br /> p-&gt;signal because on exec() a TGID targeted timer is inherited.<br /> <br /> As sys_timer_delete() freed the underlying posix timer object<br /> run_posix_cpu_timers() or any timerqueue related add/delete operations on<br /> other timers will access the freed object&amp;#39;s timerqueue node, which results<br /> in an UAF.<br /> <br /> There is a similar problem vs. posix_cpu_timer_set(). For regular posix<br /> timers it just transiently returns -ESRCH to user space, but for the use<br /> case in do_cpu_nanosleep() it&amp;#39;s the same UAF just that the k_itimer is<br /> allocated on the stack.<br /> <br /> Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops<br /> to expire.<br /> <br /> While debating solutions Frederic pointed out another problem:<br /> <br /> posix_cpu_timer_del(tmr)<br /> __exit_signal(p)<br /> posix_cpu_timers*_exit(p);<br /> unhash_task(p);<br /> p-&gt;sighand = NULL;<br /> sh = lock_task_sighand(p)<br /> sighand = p-&gt;sighand;<br /> if (!sighand)<br /> return NULL;<br /> lock(sighand);<br /> <br /> if (!sh)<br /> WARN_ON_ONCE(timer_queued(tmr));<br /> <br /> On weakly ordered architectures it is not guaranteed that<br /> posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()<br /> when p-&gt;sighand is observed as NULL, which means the WARN() can be a false<br /> positive.<br /> <br /> Solve these issues by:<br /> <br /> 1) Changing the store in __exit_signal() to smp_store_release().<br /> <br /> 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path<br /> of lock_task_sighand().<br /> <br /> 3) Creating a helper function for looking up the task and locking sighand<br /> which does not return when sighand == NULL. Instead it retries the<br /> task lookup and only if that fails it gives up.<br /> <br /> 4) Using that helper in the three affected functions.<br /> <br /> #1/#2 ensures that the reader side which observes sighand == NULL also<br /> observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()<br /> and the ones in unhash_task().<br /> <br /> #3 ensures that the above described non-leader exec() situation is handled<br /> gracefully. When the task lookup returns the old leader, but sighand ==<br /> NULL then it retries. In the non-leader exec() case the subsequent task<br /> lookup will observe the new leader due to #1/#2. In normal exit() scenarios<br /> the subsequent lookup fails.<br /> <br /> When the task lookup fails, the function also checks whether the timer is<br /> still enqueued and issues a warning if that&amp;#39;s the case. Unfortunately there<br /> is nothing which can be done about it, but as the task is already not<br /> longer visible the timer should not be accessed anymore. This check also<br /> requires memory ordering, which is not provided when the first lookup<br /> fails. To achieve that the check is preceeded by a smp_rmb() which pairs<br /> with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that<br /> the stores in posix_cpu_timers*_exit() are visible.<br /> <br /> The history of the non-leader exec() issue goes back to the early days of<br /> posix CPU timers, which stored a pointer to the group leader task in the<br /> timer. That obviously fails when a non-leader exec() switches the leader.<br /> commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems<br /> with mt exec") added a temporary workaround for that in 2010 which surv<br /> ---truncated---

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse&amp;#39;s PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL (https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.<br /> <br /> This vulnerability is due to the presence of static user credentials for a low-privileged&amp;nbsp;account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.&amp;nbsp;<br /> Note:&amp;nbsp;If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.&amp;nbsp;&amp;nbsp;<br /> Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted

undici&amp;#39;s setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.