Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfs: ensure sb-&gt;s_fs_info is always cleaned up<br /> <br /> When hfs was converted to the new mount api a bug was introduced by<br /> changing the allocation pattern of sb-&gt;s_fs_info. If setup_bdev_super()<br /> fails after a new superblock has been allocated by sget_fc(), but before<br /> hfs_fill_super() takes ownership of the filesystem-specific s_fs_info<br /> data it was leaked.<br /> <br /> Fix this by freeing sb-&gt;s_fs_info in hfs_kill_super().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode<br /> <br /> The local variable &amp;#39;i&amp;#39; is initialized with -EINVAL, but the for loop<br /> immediately overwrites it and -EINVAL is never returned.<br /> <br /> If no empty compression mode can be found, the function would return the<br /> out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid<br /> array access in add_iaa_compression_mode().<br /> <br /> Fix both issues by returning either a valid index or -EINVAL.

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or<br /> privilege escalation.<br /> <br /> This issue affects Directory Services: from 10.5 through 26.1.

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate nesting depth during parsing operations, allowing authenticated attackers to trigger denial of service conditions by uploading deeply nested malicious files. This results in CPU exhaustion, service degradation, or complete service unavailability.

A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_info.hpp. This manipulation causes use after free. The attack requires local access. The attack&amp;#39;s complexity is rated as high. The exploitability is reported as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> riscv: trace: fix snapshot deadlock with sbi ecall<br /> <br /> If sbi_ecall.c&amp;#39;s functions are traceable,<br /> <br /> echo "__sbi_ecall:snapshot" &gt; /sys/kernel/tracing/set_ftrace_filter<br /> <br /> may get the kernel into a deadlock.<br /> <br /> (Functions in sbi_ecall.c are excluded from tracing if<br /> CONFIG_RISCV_ALTERNATIVE_EARLY is set.)<br /> <br /> __sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code<br /> raises an IPI interrupt, which results in another call to __sbi_ecall<br /> and another snapshot...<br /> <br /> All it takes to get into this endless loop is one initial __sbi_ecall.<br /> On RISC-V systems without SSTC extension, the clock events in<br /> timer-riscv.c issue periodic sbi ecalls, making the problem easy to<br /> trigger.<br /> <br /> Always exclude the sbi_ecall.c functions from tracing to fix the<br /> potential deadlock.<br /> <br /> sbi ecalls can easiliy be logged via trace events, excluding ecall<br /> functions from function tracing is not a big limitation.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()<br /> <br /> Fix incorrect NULL check in loongson_gpio_init_irqchip().<br /> The function checks chip-&gt;parent instead of chip-&gt;irq.parents.

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single<br /> <br /> When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the following warning<br /> may be noticed:<br /> <br /> [ 3959.023862] ------------[ cut here ]------------<br /> [ 3959.023891] alloc_tag was not cleared (got tag for lib/xarray.c:378)<br /> [ 3959.023947] WARNING: ./include/linux/alloc_tag.h:155 at alloc_tag_add+0x128/0x178, CPU#6: mkfs.ntfs/113998<br /> [ 3959.023978] Modules linked in: dns_resolver tun brd overlay exfat btrfs blake2b libblake2b xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink sr_mod virtio_gpu cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper ghash_ce drm sm4 backlight virtio_net net_failover virtio_scsi failover virtio_console virtio_blk virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod i2c_dev aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject]<br /> [ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary)<br /> [ 3959.024182] Tainted: [W]=WARN<br /> [ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022<br /> [ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 3959.024199] pc : alloc_tag_add+0x128/0x178<br /> [ 3959.024207] lr : alloc_tag_add+0x128/0x178<br /> [ 3959.024214] sp : ffff80008b696d60<br /> [ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240<br /> [ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860<br /> [ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0<br /> [ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000<br /> [ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000<br /> [ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293<br /> [ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000<br /> [ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001<br /> [ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838<br /> [ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640<br /> [ 3959.024340] Call trace:<br /> [ 3959.024346] alloc_tag_add+0x128/0x178 (P)<br /> [ 3959.024355] __alloc_tagging_slab_alloc_hook+0x11c/0x1a8<br /> [ 3959.024362] kmem_cache_alloc_lru_noprof+0x1b8/0x5e8<br /> [ 3959.024369] xas_alloc+0x304/0x4f0<br /> [ 3959.024381] xas_create+0x1e0/0x4a0<br /> [ 3959.024388] xas_store+0x68/0xda8<br /> [ 3959.024395] __filemap_add_folio+0x5b0/0xbd8<br /> [ 3959.024409] filemap_add_folio+0x16c/0x7e0<br /> [ 3959.024416] __filemap_get_folio_mpol+0x2dc/0x9e8<br /> [ 3959.024424] iomap_get_folio+0xfc/0x180<br /> [ 3959.024435] __iomap_get_folio+0x2f8/0x4b8<br /> [ 3959.024441] iomap_write_begin+0x198/0xc18<br /> [ 3959.024448] iomap_write_iter+0x2ec/0x8f8<br /> [ 3959.024454] iomap_file_buffered_write+0x19c/0x290<br /> [ 3959.024461] blkdev_write_iter+0x38c/0x978<br /> [ 3959.024470] vfs_write+0x4d4/0x928<br /> [ 3959.024482] ksys_write+0xfc/0x1f8<br /> [ 3959.024489] __arm64_sys_write+0x74/0xb0<br /> [ 3959.024496] invoke_syscall+0xd4/0x258<br /> [ 3959.024507] el0_svc_common.constprop.0+0xb4/0x240<br /> [ 3959.024514] do_el0_svc+0x48/0x68<br /> [ 3959.024520] el0_svc+0x40/0xf8<br /> [ 3959.024526] el0t_64_sync_handler+0xa0/0xe8<br /> [ 3959.024533] el0t_64_sync+0x1ac/0x1b0<br /> [ 3959.024540] ---[ end trace 0000000000000000 ]---<br /> <br /> When __memcg_slab_post_alloc_hook() fails, there are two different<br /> free paths depending on whether size == 1 or size != 1. In the<br /> kmem_cache_free_bulk() path, we do call alloc_tagging_slab_free_hook().<br /> However, in memcg_alloc_abort_single() we don&amp;#39;t, the above warning will be<br /> triggered on the next allocation.<br /> <br /> Therefore, add alloc_tagging_slab_free_hook() to the<br /> memcg_alloc_abort_single() path.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm, swap: restore swap_space attr aviod kernel panic<br /> <br /> commit 8b47299a411a ("mm, swap: mark swap address space ro and add context<br /> debug check") made the swap address space read-only. It may lead to<br /> kernel panic if arch_prepare_to_swap returns a failure under heavy memory<br /> pressure as follows,<br /> <br /> el1_abort+0x40/0x64<br /> el1h_64_sync_handler+0x48/0xcc<br /> el1h_64_sync+0x84/0x88<br /> errseq_set+0x4c/0xb8 (P)<br /> __filemap_set_wb_err+0x20/0xd0<br /> shrink_folio_list+0xc20/0x11cc<br /> evict_folios+0x1520/0x1be4<br /> try_to_shrink_lruvec+0x27c/0x3dc<br /> shrink_one+0x9c/0x228<br /> shrink_node+0xb3c/0xeac<br /> do_try_to_free_pages+0x170/0x4f0<br /> try_to_free_pages+0x334/0x534<br /> __alloc_pages_direct_reclaim+0x90/0x158<br /> __alloc_pages_slowpath+0x334/0x588<br /> __alloc_frozen_pages_noprof+0x224/0x2fc<br /> __folio_alloc_noprof+0x14/0x64<br /> vma_alloc_zeroed_movable_folio+0x34/0x44<br /> do_pte_missing+0xad4/0x1040<br /> handle_mm_fault+0x4a4/0x790<br /> do_page_fault+0x288/0x5f8<br /> do_translation_fault+0x38/0x54<br /> do_mem_abort+0x54/0xa8<br /> <br /> Restore swap address space as not ro to avoid the panic.