Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix potential UAF in cifs_stats_proc_show()<br /> <br /> Skip sessions that are being teared down (status == SES_EXITING) to<br /> avoid UAF.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: guarantee refcounted children from parent session<br /> <br /> Avoid potential use-after-free bugs when walking DFS referrals,<br /> mounting and performing DFS failover by ensuring that all children<br /> from parent @tcon-&gt;ses are also refcounted. They&amp;#39;re all needed across<br /> the entire DFS mount. Get rid of @tcon-&gt;dfs_ses_list while we&amp;#39;re at<br /> it, too.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix UAF in smb2_reconnect_server()<br /> <br /> The UAF bug is due to smb2_reconnect_server() accessing a session that<br /> is already being teared down by another thread that is executing<br /> __cifs_put_smb_ses(). This can happen when (a) the client has<br /> connection to the server but no session or (b) another thread ends up<br /> setting @ses-&gt;ses_status again to something different than<br /> SES_EXITING.<br /> <br /> To fix this, we need to make sure to unconditionally set<br /> @ses-&gt;ses_status to SES_EXITING and prevent any other threads from<br /> setting a new status while we&amp;#39;re still tearing it down.<br /> <br /> The following can be reproduced by adding some delay to right after<br /> the ipc is freed in __cifs_put_smb_ses() - which will give<br /> smb2_reconnect_server() worker a chance to run and then accessing<br /> @ses-&gt;ipc:<br /> <br /> kinit ...<br /> mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10<br /> [disconnect srv]<br /> ls /mnt/1 &amp;&gt;/dev/null<br /> sleep 30<br /> kdestroy<br /> [reconnect srv]<br /> sleep 10<br /> umount /mnt/1<br /> ...<br /> CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed<br /> CIFS: VFS: \\srv Send error in SessSetup = -126<br /> CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed<br /> CIFS: VFS: \\srv Send error in SessSetup = -126<br /> general protection fault, probably for non-canonical address<br /> 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI<br /> CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39<br /> 04/01/2014<br /> Workqueue: cifsiod smb2_reconnect_server [cifs]<br /> RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0<br /> Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad<br /> de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 8b 01 48 39 f8 75<br /> 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8<br /> RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83<br /> RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b<br /> RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800<br /> RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000<br /> R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000<br /> R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000<br /> FS: 0000000000000000(0000) GS:ffff888157c00000(0000)<br /> knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> ? die_addr+0x36/0x90<br /> ? exc_general_protection+0x1c1/0x3f0<br /> ? asm_exc_general_protection+0x26/0x30<br /> ? __list_del_entry_valid_or_report+0x33/0xf0<br /> __cifs_put_smb_ses+0x1ae/0x500 [cifs]<br /> smb2_reconnect_server+0x4ed/0x710 [cifs]<br /> process_one_work+0x205/0x6b0<br /> worker_thread+0x191/0x360<br /> ? __pfx_worker_thread+0x10/0x10<br /> kthread+0xe2/0x110<br /> ? __pfx_kthread+0x10/0x10<br /> ret_from_fork+0x34/0x50<br /> ? __pfx_kthread+0x10/0x10<br /> ret_from_fork_asm+0x1a/0x30<br />

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/secretmem: fix GUP-fast succeeding on secretmem folios<br /> <br /> folio_is_secretmem() currently relies on secretmem folios being LRU<br /> folios, to save some cycles.<br /> <br /> However, folios might reside in a folio batch without the LRU flag set, or<br /> temporarily have their LRU flag cleared. Consequently, the LRU flag is<br /> unreliable for this purpose.<br /> <br /> In particular, this is the case when secretmem_fault() allocates a fresh<br /> page and calls filemap_add_folio()-&gt;folio_add_lru(). The folio might be<br /> added to the per-cpu folio batch and won&amp;#39;t get the LRU flag set until the<br /> batch was drained using e.g., lru_add_drain().<br /> <br /> Consequently, folio_is_secretmem() might not detect secretmem folios and<br /> GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel<br /> when we would later try reading/writing to the folio, because the folio<br /> has been unmapped from the directmap.<br /> <br /> Fix it by removing that unreliable check.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> aio: Fix null ptr deref in aio_complete() wakeup<br /> <br /> list_del_init_careful() needs to be the last access to the wait queue<br /> entry - it effectively unlocks access.<br /> <br /> Previously, finish_wait() would see the empty list head and skip taking<br /> the lock, and then we&amp;#39;d return - but the completion path would still<br /> attempt to do the wakeup after the task_struct pointer had been<br /> overwritten.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/coco: Require seeding RNG with RDRAND on CoCo systems<br /> <br /> There are few uses of CoCo that don&amp;#39;t rely on working cryptography and<br /> hence a working RNG. Unfortunately, the CoCo threat model means that the<br /> VM host cannot be trusted and may actively work against guests to<br /> extract secrets or manipulate computation. Since a malicious host can<br /> modify or observe nearly all inputs to guests, the only remaining source<br /> of entropy for CoCo guests is RDRAND.<br /> <br /> If RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole<br /> is meant to gracefully continue on gathering entropy from other sources,<br /> but since there aren&amp;#39;t other sources on CoCo, this is catastrophic.<br /> This is mostly a concern at boot time when initially seeding the RNG, as<br /> after that the consequences of a broken RDRAND are much more<br /> theoretical.<br /> <br /> So, try at boot to seed the RNG using 256 bits of RDRAND output. If this<br /> fails, panic(). This will also trigger if the system is booted without<br /> RDRAND, as RDRAND is essential for a safe CoCo boot.<br /> <br /> Add this deliberately to be "just a CoCo x86 driver feature" and not<br /> part of the RNG itself. Many device drivers and platforms have some<br /> desire to contribute something to the RNG, and add_device_randomness()<br /> is specifically meant for this purpose.<br /> <br /> Any driver can call it with seed data of any quality, or even garbage<br /> quality, and it can only possibly make the quality of the RNG better or<br /> have no effect, but can never make it worse.<br /> <br /> Rather than trying to build something into the core of the RNG, consider<br /> the particular CoCo issue just a CoCo issue, and therefore separate it<br /> all out into driver (well, arch/platform) code.<br /> <br /> [ bp: Massage commit message. ]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: support deferring bpf_link dealloc to after RCU grace period<br /> <br /> BPF link for some program types is passed as a "context" which can be<br /> used by those BPF programs to look up additional information. E.g., for<br /> multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values.<br /> <br /> Because of this runtime dependency, when bpf_link refcnt drops to zero<br /> there could still be active BPF programs running accessing link data.<br /> <br /> This patch adds generic support to defer bpf_link dealloc callback to<br /> after RCU GP, if requested. This is done by exposing two different<br /> deallocation callbacks, one synchronous and one deferred. If deferred<br /> one is provided, bpf_link_free() will schedule dealloc_deferred()<br /> callback to happen after RCU GP.<br /> <br /> BPF is using two flavors of RCU: "classic" non-sleepable one and RCU<br /> tasks trace one. The latter is used when sleepable BPF programs are<br /> used. bpf_link_free() accommodates that by checking underlying BPF<br /> program&amp;#39;s sleepable flag, and goes either through normal RCU GP only for<br /> non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP<br /> (taking into account rcu_trace_implies_rcu_gp() optimization), if BPF<br /> program is sleepable.<br /> <br /> We use this for multi-kprobe and multi-uprobe links, which dereference<br /> link during program run. We also preventively switch raw_tp link to use<br /> deferred dealloc callback, as upcoming changes in bpf-next tree expose<br /> raw_tp link data (specifically, cookie value) to BPF program at runtime<br /> as well.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()<br /> <br /> Skip sessions that are being teared down (status == SES_EXITING) to<br /> avoid UAF.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix potential UAF in smb2_is_network_name_deleted()<br /> <br /> Skip sessions that are being teared down (status == SES_EXITING) to<br /> avoid UAF.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix potential UAF in is_valid_oplock_break()<br /> <br /> Skip sessions that are being teared down (status == SES_EXITING) to<br /> avoid UAF.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix potential UAF in smb2_is_valid_lease_break()<br /> <br /> Skip sessions that are being teared down (status == SES_EXITING) to<br /> avoid UAF.

A vulnerability was found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updateprice.php. The manipulation of the argument ITEM leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265082 is the identifier assigned to this vulnerability.