Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cxgb4: avoid accessing registers when clearing filters<br /> <br /> Hardware register having the server TID base can contain<br /> invalid values when adapter is in bad state (for example,<br /> due to AER fatal error). Reading these invalid values in the<br /> register can lead to out-of-bound memory access. So, fix<br /> by using the saved server TID base when clearing filters.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: lantiq: fix memory corruption in RX ring<br /> <br /> In a situation where memory allocation or dma mapping fails, an<br /> invalid address is programmed into the descriptor. This can lead<br /> to memory corruption. If the memory allocation fails, DMA should<br /> reuse the previous skb and mapping and drop the packet. This patch<br /> also increments rx drop counter.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/amd: Clear DMA ops when switching domain<br /> <br /> Since commit 08a27c1c3ecf ("iommu: Add support to change default domain<br /> of an iommu group") a user can switch a device between IOMMU and direct<br /> DMA through sysfs. This doesn&amp;#39;t work for AMD IOMMU at the moment because<br /> dev-&gt;dma_ops is not cleared when switching from a DMA to an identity<br /> IOMMU domain. The DMA layer thus attempts to use the dma-iommu ops on an<br /> identity domain, causing an oops:<br /> <br /> # echo 0000:00:05.0 &gt; /sys/sys/bus/pci/drivers/e1000e/unbind<br /> # echo identity &gt; /sys/bus/pci/devices/0000:00:05.0/iommu_group/type<br /> # echo 0000:00:05.0 &gt; /sys/sys/bus/pci/drivers/e1000e/bind<br /> ...<br /> BUG: kernel NULL pointer dereference, address: 0000000000000028<br /> ...<br /> Call Trace:<br /> iommu_dma_alloc<br /> e1000e_setup_tx_resources<br /> e1000e_open<br /> <br /> Since iommu_change_dev_def_domain() calls probe_finalize() again, clear<br /> the dma_ops there like Vt-d does.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: zero-initialize tc skb extension on allocation<br /> <br /> Function skb_ext_add() doesn&amp;#39;t initialize created skb extension with any<br /> value and leaves it up to the user. However, since extension of type<br /> TC_SKB_EXT originally contained only single value tc_skb_ext-&gt;chain its<br /> users used to just assign the chain value without setting whole extension<br /> memory to zero first. This assumption changed when TC_SKB_EXT extension was<br /> extended with additional fields but not all users were updated to<br /> initialize the new fields which leads to use of uninitialized memory<br /> afterwards. UBSAN log:<br /> <br /> [ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28<br /> [ 778.301495] load of value 107 is not a valid value for type &amp;#39;_Bool&amp;#39;<br /> [ 778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2<br /> [ 778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014<br /> [ 778.307901] Call Trace:<br /> [ 778.308680] <br /> [ 778.309358] dump_stack+0xbb/0x107<br /> [ 778.310307] ubsan_epilogue+0x5/0x40<br /> [ 778.311167] __ubsan_handle_load_invalid_value.cold+0x43/0x48<br /> [ 778.312454] ? memset+0x20/0x40<br /> [ 778.313230] ovs_flow_key_extract.cold+0xf/0x14 [openvswitch]<br /> [ 778.314532] ovs_vport_receive+0x19e/0x2e0 [openvswitch]<br /> [ 778.315749] ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch]<br /> [ 778.317188] ? create_prof_cpu_mask+0x20/0x20<br /> [ 778.318220] ? arch_stack_walk+0x82/0xf0<br /> [ 778.319153] ? secondary_startup_64_no_verify+0xb0/0xbb<br /> [ 778.320399] ? stack_trace_save+0x91/0xc0<br /> [ 778.321362] ? stack_trace_consume_entry+0x160/0x160<br /> [ 778.322517] ? lock_release+0x52e/0x760<br /> [ 778.323444] netdev_frame_hook+0x323/0x610 [openvswitch]<br /> [ 778.324668] ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch]<br /> [ 778.325950] __netif_receive_skb_core+0x771/0x2db0<br /> [ 778.327067] ? lock_downgrade+0x6e0/0x6f0<br /> [ 778.328021] ? lock_acquire+0x565/0x720<br /> [ 778.328940] ? generic_xdp_tx+0x4f0/0x4f0<br /> [ 778.329902] ? inet_gro_receive+0x2a7/0x10a0<br /> [ 778.330914] ? lock_downgrade+0x6f0/0x6f0<br /> [ 778.331867] ? udp4_gro_receive+0x4c4/0x13e0<br /> [ 778.332876] ? lock_release+0x52e/0x760<br /> [ 778.333808] ? dev_gro_receive+0xcc8/0x2380<br /> [ 778.334810] ? lock_downgrade+0x6f0/0x6f0<br /> [ 778.335769] __netif_receive_skb_list_core+0x295/0x820<br /> [ 778.336955] ? process_backlog+0x780/0x780<br /> [ 778.337941] ? mlx5e_rep_tc_netdevice_event_unregister+0x20/0x20 [mlx5_core]<br /> [ 778.339613] ? seqcount_lockdep_reader_access.constprop.0+0xa7/0xc0<br /> [ 778.341033] ? kvm_clock_get_cycles+0x14/0x20<br /> [ 778.342072] netif_receive_skb_list_internal+0x5f5/0xcb0<br /> [ 778.343288] ? __kasan_kmalloc+0x7a/0x90<br /> [ 778.344234] ? mlx5e_handle_rx_cqe_mpwrq+0x9e0/0x9e0 [mlx5_core]<br /> [ 778.345676] ? mlx5e_xmit_xdp_frame_mpwqe+0x14d0/0x14d0 [mlx5_core]<br /> [ 778.347140] ? __netif_receive_skb_list_core+0x820/0x820<br /> [ 778.348351] ? mlx5e_post_rx_mpwqes+0xa6/0x25d0 [mlx5_core]<br /> [ 778.349688] ? napi_gro_flush+0x26c/0x3c0<br /> [ 778.350641] napi_complete_done+0x188/0x6b0<br /> [ 778.351627] mlx5e_napi_poll+0x373/0x1b80 [mlx5_core]<br /> [ 778.352853] __napi_poll+0x9f/0x510<br /> [ 778.353704] ? mlx5_flow_namespace_set_mode+0x260/0x260 [mlx5_core]<br /> [ 778.355158] net_rx_action+0x34c/0xa40<br /> [ 778.356060] ? napi_threaded_poll+0x3d0/0x3d0<br /> [ 778.357083] ? sched_clock_cpu+0x18/0x190<br /> [ 778.358041] ? __common_interrupt+0x8e/0x1a0<br /> [ 778.359045] __do_softirq+0x1ce/0x984<br /> [ 778.359938] __irq_exit_rcu+0x137/0x1d0<br /> [ 778.360865] irq_exit_rcu+0xa/0x20<br /> [ 778.361708] common_interrupt+0x80/0xa0<br /> [ 778.362640] <br /> [ 778.363212] asm_common_interrupt+0x1e/0x40<br /> [ 778.364204] RIP: 0010:native_safe_halt+0xe/0x10<br /> [ 778.365273] Code: 4f ff ff ff 4c 89 e7 e8 50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00 0f 00 2d 74 05 62 00 fb f4 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4 c3 cc cc 0f 1f 44 00<br /> [ 778.369355] RSP: 0018:ffffffff84407e48 EFLAGS: 00000246<br /> [ 778.370570] RAX<br /> ---truncated---

Anope before 2.0.15 does not prevent resetting the password of a suspended account.

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.

Improper Neutralization of Special Elements used in an OS Command (&amp;#39;OS Command Injection&amp;#39;), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files https://gitee.Com/openeuler/migration-tools/blob/master/index.Py.<br /> <br /> This issue affects migration-tools: from 1.0.0 through 1.0.1.<br /> <br />

Improper Neutralization of Special Elements used in a Command (&amp;#39;Command Injection&amp;#39;) vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.<br /> <br /> This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.<br /> <br />

Improper Neutralization of Special Elements used in an OS Command (&amp;#39;OS Command Injection&amp;#39;) vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.<br /> <br /> This issue affects aops-zeus: from 1.2.0 through 1.4.0.<br /> <br />

Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administrator privilege may perform I/O to arbitrary hardware port or physical address, resulting in erasing or altering the firmware.

<br /> This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.<br /> <br />