Vulnerabilities

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/core: Fix ETH_P_1588 flow dissector<br /> <br /> When a PTP ethernet raw frame with a size of more than 256 bytes followed<br /> by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation<br /> is wrong. For example: hdr-&gt;message_length takes the wrong value (0xffff)<br /> and it does not replicate real header length. In this case, &amp;#39;nhoff&amp;#39; value<br /> was overridden and the PTP header was badly dissected. This leads to a<br /> kernel crash.<br /> <br /> net/core: flow_dissector<br /> net/core flow dissector nhoff = 0x0000000e<br /> net/core flow dissector hdr-&gt;message_length = 0x0000ffff<br /> net/core flow dissector nhoff = 0x0001000d (u16 overflow)<br /> ...<br /> skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88<br /> skb frag: 00000000: f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> <br /> Using the size of the ptp_header struct will allow the corrected<br /> calculation of the nhoff value.<br /> <br /> net/core flow dissector nhoff = 0x0000000e<br /> net/core flow dissector nhoff = 0x00000030 (sizeof ptp_header)<br /> ...<br /> skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 f7 ff ff<br /> skb linear: 00000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> skb linear: 00000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> skb frag: 00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> <br /> Kernel trace:<br /> [ 74.984279] ------------[ cut here ]------------<br /> [ 74.989471] kernel BUG at include/linux/skbuff.h:2440!<br /> [ 74.995237] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI<br /> [ 75.001098] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G U 5.15.85-intel-ese-standard-lts #1<br /> [ 75.011629] Hardware name: Intel Corporation A-Island (CPU:AlderLake)/A-Island (ID:06), BIOS SB_ADLP.01.01.00.01.03.008.D-6A9D9E73-dirty Mar 30 2023<br /> [ 75.026507] RIP: 0010:eth_type_trans+0xd0/0x130<br /> [ 75.031594] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9<br /> [ 75.052612] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297<br /> [ 75.058473] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003<br /> [ 75.066462] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300<br /> [ 75.074458] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800<br /> [ 75.082466] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010<br /> [ 75.090461] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800<br /> [ 75.098464] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000<br /> [ 75.107530] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 75.113982] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0<br /> [ 75.121980] PKRU: 55555554<br /> [ 75.125035] Call Trace:<br /> [ 75.127792] <br /> [ 75.130063] ? eth_get_headlen+0xa4/0xc0<br /> [ 75.134472] igc_process_skb_fields+0xcd/0x150<br /> [ 75.139461] igc_poll+0xc80/0x17b0<br /> [ 75.143272] __napi_poll+0x27/0x170<br /> [ 75.147192] net_rx_action+0x234/0x280<br /> [ 75.151409] __do_softirq+0xef/0x2f4<br /> [ 75.155424] irq_exit_rcu+0xc7/0x110<br /> [ 75.159432] common_interrupt+0xb8/0xd0<br /> [ 75.163748] <br /> [ 75.166112] <br /> [ 75.168473] asm_common_interrupt+0x22/0x40<br /> [ 75.173175] RIP: 0010:cpuidle_enter_state+0xe2/0x350<br /> [ 75.178749] Code: 85 c0 0f 8f 04 02 00 00 31 ff e8 39 6c 67 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 50 02 00 00 31 ff e8 52 b0 6d ff fb 45 85 f6 88 b1 00 00 00 49 63 ce 4c 2b 2c 24 48 89 c8 48 6b d1 68 48 c1<br /> [ 75.199757] RSP: 0018:ffff9948c013bea8 EFLAGS: 00000202<br /> [ 75.205614] RAX: ffff8e4e8fb00000 RBX: ffffb948bfd23900 RCX: 000000000000001f<br /> [ 75.213619] RDX: 0000000000000004 RSI: ffffffff94206161 RDI: ffffffff94212e20<br /> [ 75.221620] RBP: 0000000000000004 R08: 000000117568973a R09: 0000000000000001<br /> [ 75.229622] R10: 000000000000afc8 R11: ffff8e4e8fb29ce4 R12: ffffffff945ae980<br /> [ 75.237628] R13: 000000117568973a R14: 0000000000000004 R15: 0000000000000000<br /> [ 75.245635] ? <br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: fix memleak when more than 255 elements expired<br /> <br /> When more than 255 elements expired we&amp;#39;re supposed to switch to a new gc<br /> container structure.<br /> <br /> This never happens: u8 type will wrap before reaching the boundary<br /> and nft_trans_gc_space() always returns true.<br /> <br /> This means we recycle the initial gc container structure and<br /> lose track of the elements that came before.<br /> <br /> While at it, don&amp;#39;t deref &amp;#39;gc&amp;#39; after we&amp;#39;ve passed it to call_rcu.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Only call folio_start_fscache() one time for each folio<br /> <br /> If a network filesystem using netfs implements a clamp_length()<br /> function, it can set subrequest lengths smaller than a page size.<br /> <br /> When we loop through the folios in netfs_rreq_unlock_folios() to<br /> set any folios to be written back, we need to make sure we only<br /> call folio_start_fscache() once for each folio.<br /> <br /> Otherwise, this simple testcase:<br /> <br /> mount -o fsc,rsize=1024,wsize=1024 127.0.0.1:/export /mnt/nfs<br /> dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1<br /> 1+0 records in<br /> 1+0 records out<br /> 4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s<br /> echo 3 &gt; /proc/sys/vm/drop_caches<br /> cat /mnt/nfs/file.bin &gt; /dev/null<br /> <br /> will trigger an oops similar to the following:<br /> <br /> page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio))<br /> ------------[ cut here ]------------<br /> kernel BUG at include/linux/netfs.h:44!<br /> ...<br /> CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5<br /> ...<br /> RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs]<br /> ...<br /> Call Trace:<br /> netfs_rreq_assess+0x497/0x660 [netfs]<br /> netfs_subreq_terminated+0x32b/0x610 [netfs]<br /> nfs_netfs_read_completion+0x14e/0x1a0 [nfs]<br /> nfs_read_completion+0x2f9/0x330 [nfs]<br /> rpc_free_task+0x72/0xa0 [sunrpc]<br /> rpc_async_release+0x46/0x70 [sunrpc]<br /> process_one_work+0x3bd/0x710<br /> worker_thread+0x89/0x610<br /> kthread+0x181/0x1c0<br /> ret_from_fork+0x29/0x50

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit<br /> <br /> The EHL (Elkhart Lake) based platforms provide a OOB (Out of band)<br /> service, which allows to wakup device when the system is in S5 (Soft-Off<br /> state). This OOB service can be enabled/disabled from BIOS settings. When<br /> enabled, the ISH device gets PME wake capability. To enable PME wakeup,<br /> driver also needs to enable ACPI GPE bit.<br /> <br /> On resume, BIOS will clear the wakeup bit. So driver need to re-enable it<br /> in resume function to keep the next wakeup capability. But this BIOS<br /> clearing of wakeup bit doesn&amp;#39;t decrement internal OS GPE reference count,<br /> so this reenabling on every resume will cause reference count to overflow.<br /> <br /> So first disable and reenable ACPI GPE bit using acpi_disable_gpe().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> platform/x86: think-lmi: Fix reference leak<br /> <br /> If a duplicate attribute is found using kset_find_obj(), a reference<br /> to that attribute is returned which needs to be disposed accordingly<br /> using kobject_put(). Move the setting name validation into a separate<br /> function to allow for this change without having to duplicate the<br /> cleanup code for this setting.<br /> As a side note, a very similar bug was fixed in<br /> commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"),<br /> so it seems that the bug was copied from that driver.<br /> <br /> Compile-tested only.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: fix possible store tearing in neigh_periodic_work()<br /> <br /> While looking at a related syzbot report involving neigh_periodic_work(),<br /> I found that I forgot to add an annotation when deleting an<br /> RCU protected item from a list.<br /> <br /> Readers use rcu_deference(*np), we need to use either<br /> rcu_assign_pointer() or WRITE_ONCE() on writer side<br /> to prevent store tearing.<br /> <br /> I use rcu_assign_pointer() to have lockdep support,<br /> this was the choice made in neigh_flush_dev().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets<br /> <br /> With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages<br /> sent from one TCP socket (s1) to actually egress from another TCP<br /> socket (s2):<br /> <br /> tcp_bpf_sendmsg(s1) // = sk_prot-&gt;sendmsg<br /> tcp_bpf_send_verdict(s1) // __SK_REDIRECT case<br /> tcp_bpf_sendmsg_redir(s2)<br /> tcp_bpf_push_locked(s2)<br /> tcp_bpf_push(s2)<br /> tcp_rate_check_app_limited(s2) // expects tcp_sock<br /> tcp_sendmsg_locked(s2) // ditto<br /> <br /> There is a hard-coded assumption in the call-chain, that the egress<br /> socket (s2) is a TCP socket.<br /> <br /> However in commit 122e6c79efe1 ("sock_map: Update sock type checks for<br /> UDP") we have enabled redirects to non-TCP sockets. This was done for the<br /> sake of BPF sk_skb programs. There was no indention to support sk_msg<br /> send-to-egress use case.<br /> <br /> As a result, attempts to send-to-egress through a non-TCP socket lead to a<br /> crash due to invalid downcast from sock to tcp_sock:<br /> <br /> BUG: kernel NULL pointer dereference, address: 000000000000002f<br /> ...<br /> Call Trace:<br /> <br /> ? show_regs+0x60/0x70<br /> ? __die+0x1f/0x70<br /> ? page_fault_oops+0x80/0x160<br /> ? do_user_addr_fault+0x2d7/0x800<br /> ? rcu_is_watching+0x11/0x50<br /> ? exc_page_fault+0x70/0x1c0<br /> ? asm_exc_page_fault+0x27/0x30<br /> ? tcp_tso_segs+0x14/0xa0<br /> tcp_write_xmit+0x67/0xce0<br /> __tcp_push_pending_frames+0x32/0xf0<br /> tcp_push+0x107/0x140<br /> tcp_sendmsg_locked+0x99f/0xbb0<br /> tcp_bpf_push+0x19d/0x3a0<br /> tcp_bpf_sendmsg_redir+0x55/0xd0<br /> tcp_bpf_send_verdict+0x407/0x550<br /> tcp_bpf_sendmsg+0x1a1/0x390<br /> inet_sendmsg+0x6a/0x70<br /> sock_sendmsg+0x9d/0xc0<br /> ? sockfd_lookup_light+0x12/0x80<br /> __sys_sendto+0x10e/0x160<br /> ? syscall_enter_from_user_mode+0x20/0x60<br /> ? __this_cpu_preempt_check+0x13/0x20<br /> ? lockdep_hardirqs_on+0x82/0x110<br /> __x64_sys_sendto+0x1f/0x30<br /> do_syscall_64+0x38/0x90<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Reject selecting a non-TCP sockets as redirect target from a BPF sk_msg<br /> program to prevent the crash. When attempted, user will receive an EACCES<br /> error from send/sendto/sendmsg() syscall.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: nfc: llcp: Add lock when modifying device list<br /> <br /> The device list needs its associated lock held when modifying it, or the<br /> list could become corrupted, as syzbot discovered.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet<br /> <br /> Only skip the code path trying to access the rfc1042 headers when the<br /> buffer is too small, so the driver can still process packets without<br /> rfc1042 headers.