Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: nVMX: Hide shadow VMCS right after VMCLEAR<br /> <br /> free_nested() frees the shadow VMCS while vmcs01 still points to it. But<br /> because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU<br /> might migrate before the pointer is cleared and __loaded_vmcs_clear()<br /> may then execute VMCLEAR.<br /> <br /> The VMCS needs to stay attached until its explicit VMCLEAR completes, but<br /> then it can be hidden and the page safely freed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: don&amp;#39;t free the ASCONF&amp;#39;s own transport in DEL-IP processing<br /> <br /> sctp_process_asconf() caches the transport the ASCONF chunk is processed<br /> against in asconf-&gt;transport (== chunk-&gt;transport, set once in sctp_rcv()).<br /> For an ASCONF located through its Address Parameter by<br /> __sctp_rcv_asconf_lookup(), that cached transport corresponds to the<br /> Address Parameter, which need not be the packet&amp;#39;s source address.<br /> <br /> sctp_process_asconf_param() rejects a DEL-IP for the packet source address<br /> (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-&gt;transport.<br /> A single ASCONF can therefore carry, in order:<br /> <br /> [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]<br /> <br /> where L differs from the source. The DEL-IP for L passes the D8 check and<br /> calls sctp_assoc_rm_peer() on the transport that asconf-&gt;transport still<br /> points at, freeing it (RCU-deferred). The following wildcard DEL-IP then<br /> reuses the now-dangling asconf-&gt;transport in sctp_assoc_set_primary() and<br /> sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed<br /> transport (-&gt;ipaddr, -&gt;state) and plants the dangling pointer into<br /> asoc-&gt;peer.primary_path / active_path, and del_nonprimary_peers(), keeping<br /> only the pointer that is no longer on the list, removes every real<br /> transport, leaving the association with a transport_count of 0 and<br /> primary_path/active_path pointing at freed memory.<br /> <br /> Reject a DEL-IP that targets the transport the ASCONF is being processed<br /> against, mirroring the existing source-address guard, so the wildcard<br /> branch can never reuse a freed transport.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rhashtable: clear stale iter-&gt;p on table restart<br /> <br /> rhashtable_walk_start_check() has two restart paths when resuming a walk.<br /> When iter-&gt;walker.tbl is valid, it re-validates iter-&gt;p against the table<br /> and sets iter-&gt;p = NULL if the object is gone. When iter-&gt;walker.tbl is<br /> NULL (table was freed during resize), it resets slot and skip but forgets<br /> to clear iter-&gt;p.<br /> <br /> rhashtable_walk_next() then dereferences the stale iter-&gt;p, reading<br /> freed memory. This is a use-after-free.<br /> <br /> Any caller that does multi-fragment rhashtable walks across<br /> walk_stop/walk_start boundaries is affected. Concrete cases include<br /> netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC<br /> (tipc_nl_sk_walk in net/tipc/socket.c).<br /> <br /> Crash stack (netlink_diag):<br /> BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0<br /> Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)<br /> Call Trace:<br /> rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)<br /> __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)<br /> netlink_diag_dump+0xc2/0x240<br /> netlink_dump+0x5bc/0x1270<br /> netlink_recvmsg+0x7a3/0x980<br /> sock_recvmsg+0x1bc/0x200<br /> __sys_recvfrom+0x1d4/0x2c0

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users&amp;#39; RSVPs from any volunteer opportunity.

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available<br /> <br /> Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,<br /> after making MMU pages available for the shadow MMU. If reclaiming shadow<br /> pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to<br /> map memory into an invalid root. On its own, populating an invalid root is<br /> "fine", but because child shadow pages inherit their parent&amp;#39;s role, any<br /> children created during the map/fetch will be created as invalid pages,<br /> thus violating KVM&amp;#39;s invariant that invalid pages are never on the list of<br /> active MMU pages.<br /> <br /> Note, the underlying flaw has existed since KVM first started tracking<br /> invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root<br /> pagetables"), but the true badness only came along in 2020 (Linux 5.9)<br /> with the invariant that invalid shadow pages can&amp;#39;t be on the list of<br /> active pages.<br /> <br /> Note #2, inheriting role.invalid when creating child shadow pages is also<br /> far from ideal; that flaw will be addressed separately.

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel&amp;#39;s response storage or mail-forwarding to be configured.