Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5e: xsk: Fix unlocked writing to ICOSQ<br /> <br /> During napi poll, when the affinity changes and there&amp;#39;s still XSK work<br /> to be done, we trigger an ICOSQ interrupt on the new CPU. However, this<br /> triggering on the ICOSQ is done unprotected.<br /> <br /> There are 2 such races:<br /> <br /> A) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is<br /> running from a different CPU due to affinity change. This can happen<br /> because IRQ triggering is done after napi_complete_done(). At this point<br /> the NAPI can be scheduled on a different CPU. Like this:<br /> <br /> CPU A (old affinity, NAPI tail) CPU B (new affinity, fresh NAPI)<br /> ------------------------------- --------------------------------<br /> napi_complete_done() clears SCHED<br /> mlx5e_cq_arm(...)<br /> napi_schedule_prep() sets SCHED<br /> mlx5e_napi_poll()<br /> mlx5e_xsk_alloc_rx_mpwqe()<br /> mlx5e_icosq_sync_lock() // noop<br /> memcpy 640 B UMR body<br /> advance sq-&gt;pc by 10<br /> mlx5e_trigger_irq(&amp;c-&gt;icosq)<br /> wqe_info[pi] = {NOP, 1}<br /> mlx5e_post_nop() advances sq-&gt;pc<br /> <br /> B) mlx5e_trigger_irq() is called on the ICOSQ when<br /> mlx5e_trigger_napi_icosq() is running.<br /> <br /> The obvious fix would be to lock the ICOSQ. But ICOSQ has an optimized<br /> locking scheme that doesn&amp;#39;t work for this scenario. Kick the async ICOSQ<br /> instead which is always locked.<br /> <br /> This issue was noticed in the wild with the following splat:<br /> <br /> netdevice: ge-0-0-1: Bad OP in ICOSQ CQE: 0xd<br /> WARNING: drivers/net/ethernet/mellanox/mlx5/core/en_rx.c:826 [...]<br /> [...]<br /> Call Trace:<br /> <br /> mlx5e_napi_poll+0x11d/0x7f0 [mlx5_core]<br /> __napi_poll+0x30/0x200<br /> ? skb_defer_free_flush+0x9c/0xc0<br /> net_rx_action+0x2fe/0x3f0<br /> handle_softirqs+0xd8/0x340<br /> __irq_exit_rcu+0xbc/0xe0<br /> common_interrupt+0x85/0xa0<br /> <br /> <br /> asm_common_interrupt+0x26/0x40<br /> [...]<br /> ---[ end trace 0000000000000000 ]---<br /> mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2022, qn 0x8f4,<br /> opcode 0xd, syndrome 0x2, vendor syndrome 0x68<br /> 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> 00000030: 00 00 00 00 01 00 68 02 01 00 08 f4 de 14 59 d2<br /> WQE DUMP: WQ size 16384 WQ cur size 0, WQE index 0x1e14, len: 64<br /> 00000000: 00 00 00 01 d9 ed 80 02 00 00 00 01 d9 ed 90 02<br /> 00000010: 00 00 00 01 d9 ed a0 02 00 00 00 01 d9 ed b0 02<br /> 00000020: 00 00 00 01 d9 ed c0 02 00 00 00 01 d9 ed d0 02<br /> 00000030: 00 00 00 01 d9 ed e0 02 00 00 00 01 d9 ed f0 02<br /> mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2023, qn 0x8f4,<br /> opcode 0xd, syndrome 0x5, vendor syndrome 0xf9<br /> 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br /> 00000030: 00 00 00 00 01 00 f9 05 01 00 08 f4 de 15 cf d2

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm&amp;#39;s authorization.

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin&amp;#39;s core booking functionality.

Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS.<br /> <br /> This issue affects Website Template: before v2.

The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.<br /> <br /> During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.<br /> <br /> An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.<br /> <br /> The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like &amp;#39;../../.bashrc&amp;#39; to overwrite sensitive files and achieve persistent code execution.

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server&amp;#39;s replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.<br /> <br /> Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.<br /> <br /> Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.