Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ext4: check and assert if marking an no_delete evicting inode dirty<br /> <br /> In ext4_evict_inode(), if we evicting an inode in the &amp;#39;no_delete&amp;#39; path,<br /> it cannot be raced by another mark_inode_dirty(). If it happens,<br /> someone else may accidentally dirty it without holding inode refcount<br /> and probably cause use-after-free issues in the writeback procedure.<br /> It&amp;#39;s indiscoverable and hard to debug, so add an WARN_ON_ONCE() to<br /> check and detect this issue in advance.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/meson: reorder driver deinit sequence to fix use-after-free bug<br /> <br /> Unloading the driver triggers the following KASAN warning:<br /> <br /> [ +0.006275] =============================================================<br /> [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0<br /> [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695<br /> <br /> [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1<br /> [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT)<br /> [ +0.000008] Call trace:<br /> [ +0.000007] dump_backtrace+0x1ec/0x280<br /> [ +0.000013] show_stack+0x24/0x80<br /> [ +0.000008] dump_stack_lvl+0x98/0xd4<br /> [ +0.000011] print_address_description.constprop.0+0x80/0x520<br /> [ +0.000011] print_report+0x128/0x260<br /> [ +0.000007] kasan_report+0xb8/0xfc<br /> [ +0.000008] __asan_report_load8_noabort+0x3c/0x50<br /> [ +0.000010] __list_del_entry_valid+0xe0/0x1a0<br /> [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm]<br /> [ +0.000172] drm_bridge_detach+0x94/0x260 [drm]<br /> [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm]<br /> [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm]<br /> [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm]<br /> [ +0.000144] drm_managed_release+0x170/0x414 [drm]<br /> [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm]<br /> [ +0.000143] drm_dev_put+0x20/0x30 [drm]<br /> [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm]<br /> [ +0.000028] take_down_aggregate_device+0xb0/0x160<br /> [ +0.000016] component_del+0x18c/0x360<br /> [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]<br /> [ +0.000015] platform_remove+0x64/0xb0<br /> [ +0.000009] device_remove+0xb8/0x154<br /> [ +0.000009] device_release_driver_internal+0x398/0x5b0<br /> [ +0.000009] driver_detach+0xac/0x1b0<br /> [ +0.000009] bus_remove_driver+0x158/0x29c<br /> [ +0.000009] driver_unregister+0x70/0xb0<br /> [ +0.000008] platform_driver_unregister+0x20/0x2c<br /> [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]<br /> [ +0.000012] __do_sys_delete_module+0x288/0x400<br /> [ +0.000011] __arm64_sys_delete_module+0x5c/0x80<br /> [ +0.000009] invoke_syscall+0x74/0x260<br /> [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260<br /> [ +0.000009] do_el0_svc+0x50/0x70<br /> [ +0.000007] el0_svc+0x68/0x1a0<br /> [ +0.000012] el0t_64_sync_handler+0x11c/0x150<br /> [ +0.000008] el0t_64_sync+0x18c/0x190<br /> <br /> [ +0.000018] Allocated by task 0:<br /> [ +0.000007] (stack is not available)<br /> <br /> [ +0.000011] Freed by task 2695:<br /> [ +0.000008] kasan_save_stack+0x2c/0x5c<br /> [ +0.000011] kasan_set_track+0x2c/0x40<br /> [ +0.000008] kasan_set_free_info+0x28/0x50<br /> [ +0.000009] ____kasan_slab_free+0x128/0x1d4<br /> [ +0.000008] __kasan_slab_free+0x18/0x24<br /> [ +0.000007] slab_free_freelist_hook+0x108/0x230<br /> [ +0.000011] kfree+0x110/0x35c<br /> [ +0.000008] release_nodes+0xf0/0x16c<br /> [ +0.000009] devres_release_group+0x180/0x270<br /> [ +0.000008] component_unbind+0x128/0x1e0<br /> [ +0.000010] component_unbind_all+0x1b8/0x264<br /> [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm]<br /> [ +0.000025] take_down_aggregate_device+0xb0/0x160<br /> [ +0.000009] component_del+0x18c/0x360<br /> [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]<br /> [ +0.000012] platform_remove+0x64/0xb0<br /> [ +0.000008] device_remove+0xb8/0x154<br /> [ +0.000009] device_release_driver_internal+0x398/0x5b0<br /> [ +0.000009] driver_detach+0xac/0x1b0<br /> [ +0.000009] bus_remove_driver+0x158/0x29c<br /> [ +0.000008] driver_unregister+0x70/0xb0<br /> [ +0.000008] platform_driver_unregister+0x20/0x2c<br /> [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]<br /> [ +0.000011] __do_sys_delete_module+0x288/0x400<br /> [ +0.000010] __arm64_sys_delete_module+0x5c/0x80<br /> [ +0.000008] invoke_syscall+0x74/0x260<br /> [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260<br /> [ +0.000008] do_el0_svc+0x50/0x70<br /> [ +0.000007] el0_svc+0x68/0x1a0<br /> [ +0.000009] el0t_64_sync_handler+0x11c/0x150<br /> [ +0.000009] el0t_64_sync+0x18c/0x190<br /> <br /> [ +0.000014] The buggy address belongs to the object at ffff000020c39000<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix race between quota enable and quota rescan ioctl<br /> <br /> When enabling quotas, at btrfs_quota_enable(), after committing the<br /> transaction, we change fs_info-&gt;quota_root to point to the quota root we<br /> created and set BTRFS_FS_QUOTA_ENABLED at fs_info-&gt;flags. Then we try<br /> to start the qgroup rescan worker, first by initializing it with a call<br /> to qgroup_rescan_init() - however if that fails we end up freeing the<br /> quota root but we leave fs_info-&gt;quota_root still pointing to it, this<br /> can later result in a use-after-free somewhere else.<br /> <br /> We have previously set the flags BTRFS_FS_QUOTA_ENABLED and<br /> BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at<br /> btrfs_quota_enable(), which is possible if someone already called the<br /> quota rescan ioctl, and therefore started the rescan worker.<br /> <br /> So fix this by ignoring an -EINPROGRESS and asserting we can&amp;#39;t get any<br /> other error.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm: /proc/pid/smaps_rollup: fix no vma&amp;#39;s null-deref<br /> <br /> Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value<br /> seq_file") introduced a null-deref if there are no vma&amp;#39;s in the task in<br /> show_smaps_rollup.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md: fix a crash in mempool_free<br /> <br /> There&amp;#39;s a crash in mempool_free when running the lvm test<br /> shell/lvchange-rebuild-raid.sh.<br /> <br /> The reason for the crash is this:<br /> * super_written calls atomic_dec_and_test(&amp;mddev-&gt;pending_writes) and<br /> wake_up(&amp;mddev-&gt;sb_wait). Then it calls rdev_dec_pending(rdev, mddev)<br /> and bio_put(bio).<br /> * so, the process that waited on sb_wait and that is woken up is racing<br /> with bio_put(bio).<br /> * if the process wins the race, it calls bioset_exit before bio_put(bio)<br /> is executed.<br /> * bio_put(bio) attempts to free a bio into a destroyed bio set - causing<br /> a crash in mempool_free.<br /> <br /> We fix this bug by moving bio_put before atomic_dec_and_test.<br /> <br /> We also move rdev_dec_pending before atomic_dec_and_test as suggested by<br /> Neil Brown.<br /> <br /> The function md_end_flush has a similar bug - we must call bio_put before<br /> we decrement the number of in-progress bios.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> #PF: supervisor write access in kernel mode<br /> #PF: error_code(0x0002) - not-present page<br /> PGD 11557f0067 P4D 11557f0067 PUD 0<br /> Oops: 0002 [#1] PREEMPT SMP<br /> CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014<br /> Workqueue: kdelayd flush_expired_bios [dm_delay]<br /> RIP: 0010:mempool_free+0x47/0x80<br /> Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00<br /> RSP: 0018:ffff88910036bda8 EFLAGS: 00010093<br /> RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001<br /> RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8<br /> RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900<br /> R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000<br /> R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05<br /> FS: 0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0<br /> Call Trace:<br /> <br /> clone_endio+0xf4/0x1c0 [dm_mod]<br /> clone_endio+0xf4/0x1c0 [dm_mod]<br /> __submit_bio+0x76/0x120<br /> submit_bio_noacct_nocheck+0xb6/0x2a0<br /> flush_expired_bios+0x28/0x2f [dm_delay]<br /> process_one_work+0x1b4/0x300<br /> worker_thread+0x45/0x3e0<br /> ? rescuer_thread+0x380/0x380<br /> kthread+0xc2/0x100<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork+0x1f/0x30<br /> <br /> Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd]<br /> CR2: 0000000000000000<br /> ---[ end trace 0000000000000000 ]---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> padata: Always leave BHs disabled when running -&gt;parallel()<br /> <br /> A deadlock can happen when an overloaded system runs -&gt;parallel() in the<br /> context of the current task:<br /> <br /> padata_do_parallel<br /> -&gt;parallel()<br /> pcrypt_aead_enc/dec<br /> padata_do_serial<br /> spin_lock(&amp;reorder-&gt;lock) // BHs still enabled<br /> <br /> ...<br /> __do_softirq<br /> ...<br /> padata_do_serial<br /> spin_lock(&amp;reorder-&gt;lock)<br /> <br /> It&amp;#39;s a bug for BHs to be on in _do_serial as Steffen points out, so<br /> ensure they&amp;#39;re off in the "current task" case like they are in<br /> padata_parallel_worker to avoid this situation.

A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_msg.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Profilers/PProfile/COUNT3s3.php. The manipulation of the argument csem leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.

Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.