Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virt: acrn: Fix irqfd use-after-free during eventfd shutdown<br /> <br /> acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free<br /> the same struct hsm_irqfd:<br /> <br /> CPU0 CPU1<br /> ---- ----<br /> eventfd_release()<br /> wake_up_poll(EPOLLHUP)<br /> hsm_irqfd_wakeup()<br /> queue_work(&amp;irqfd-&gt;shutdown)<br /> acrn_irqfd_deassign()<br /> hsm_irqfd_shutdown()<br /> list_del_init()<br /> eventfd_ctx_remove_wait_queue()<br /> eventfd_ctx_put()<br /> kfree(irqfd)<br /> hsm_irqfd_shutdown_work()<br /> container_of(work, ..., shutdown)<br /> irqfd-&gt;vm irqfds<br /> under irqfds_lock and queue the cleanup work.<br /> - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the<br /> eventfd waitqueue entry, drops the eventfd reference and frees the<br /> irqfd.<br /> - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()<br /> ensures the cleanup work is queued at most once, no matter how many<br /> of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to<br /> call from the waitqueue callback, which runs with wqh-&gt;lock held and<br /> IRQs disabled and therefore cannot take irqfds_lock.<br /> - acrn_irqfd_deassign() flushes vm-&gt;irqfd_wq before returning so the<br /> eventfd is fully detached on return. acrn_irqfd_deinit() deactivates<br /> every irqfd, flushes the workqueue and only then destroys it, so no<br /> path can queue_work() onto a torn-down workqueue.<br /> - acrn_irqfd_assign() now installs the eventfd waitqueue entry and<br /> publishes the irqfd to vm-&gt;irqfds under irqfds_lock, so the irqfd is<br /> never visible to deassign/deinit before its waitqueue entry is in<br /> place, and any EPOLLHUP that fires in the assign window queues<br /> cleanup work that blocks on irqfds_lock until publication is done.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: Fix condition check in acpi_ps_parse_loop()<br /> <br /> Fix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent<br /> out-of-bounds access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: addrconf: fix temp address generation after prefix deprecation<br /> <br /> When a router temporarily deprecates an IPv6 prefix (either by sending a<br /> Router Advertisement with Preferred Lifetime = 0 or by letting the<br /> lifetime expire) and later restores it, the kernel permanently loses its<br /> ability to generate temporary privacy addresses (RFC 8981) for that<br /> prefix.<br /> <br /> This happens because the address worker attempts to generate a<br /> replacement temporary address when the current one nears expiration. As<br /> the base prefix is deprecated already, the generation fails after<br /> marking the temporary address as already having spawned a replacement<br /> (ifp-&gt;regen_count++).<br /> <br /> When the router eventually restores the prefix, the temporary address<br /> becomes active again. However, once it naturally expires, the address<br /> worker sees this temporary address already tried to generate one and<br /> skips the regeneration.<br /> <br /> Fix the issue by resetting the regen_count check of the latest temp<br /> address generated for the prefix updated by the incoming RA.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()<br /> <br /> When topology_physical_package_id()/topology_logical_die_id() returns<br /> a negative value, rapl_add_package_cpuslocked() returns ERR_PTR(-EINVAL)<br /> directly without freeing the rapl_package structure that was just<br /> allocated by kzalloc_obj(), leaking memory on every failed package<br /> addition.<br /> <br /> Use the existing err_free_package label so that the allocation is<br /> released on the error path.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> thermal/drivers/tegra/soctherma: Switch to devm cooling device registration<br /> <br /> Use devm_thermal_of_cooling_device_register() to simplify resource<br /> management and avoid manual cleanup in error paths.<br /> <br /> As a side effect this change has the benefit of solving an existing<br /> issue. Before, the function tegra_soctherm_remove() only called<br /> debugfs_remove_recursive() and never called thermal_cooling_device_unregister()<br /> for any of the cooling devices registered here.<br /> <br /> After the driver removal, the thermal framework&amp;#39;s cdev list would<br /> still hold references to thermal_cooling_device objects whose devdata<br /> pointer (ts) pointed to memory already freed by the platform device&amp;#39;s<br /> devm cleanup.<br /> <br /> With this change, the cooling device is unregistered when the driver<br /> is removed, thus fixing the issue above.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rds: filter RDS_INFO_* getsockopt by caller&amp;#39;s netns<br /> <br /> The RDS_INFO_* family of getsockopt(2) options reads several<br /> file-scope global lists that are not per-netns:<br /> <br /> rds_sock_info / rds6_sock_info,<br /> rds_sock_inc_info / rds6_sock_inc_info -&gt; rds_sock_list<br /> rds_tcp_tc_info / rds6_tcp_tc_info -&gt; rds_tcp_tc_list<br /> rds_conn_info / rds6_conn_info,<br /> rds_conn_message_info_cmn (for the *_SEND_MESSAGES and<br /> *_RETRANS_MESSAGES variants),<br /> rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)<br /> -&gt; rds_conn_hash[]<br /> <br /> The handlers do not filter by the caller&amp;#39;s network namespace.<br /> rds_info_getsockopt() has no netns or capable() check, and<br /> rds_create() has no capable() check, so AF_RDS is reachable from<br /> an unprivileged user namespace. As a result, an unprivileged<br /> caller in a fresh user_ns plus netns can read the bound address<br /> and sock inode of every RDS socket on the host, the peer address<br /> of incoming messages on every RDS socket on the host, the peer<br /> address and TCP sequence numbers of every rds-tcp connection on<br /> the host, and the peer address and RDS sequence numbers of every<br /> RDS connection on the host.<br /> <br /> The rds-tcp transport is reachable from a non-initial netns (see<br /> rds_set_transport()), so a one-shot init_net gate at<br /> rds_info_getsockopt() would deny legitimate per-netns visibility<br /> to rds-tcp callers. Instead, filter at each handler by comparing<br /> the netns of the caller&amp;#39;s socket to the netns of the list entry,<br /> or to rds_conn_net(conn) for connection paths. Only copy entries<br /> whose netns matches the caller. Counters (RDS_INFO_COUNTERS) are<br /> aggregate statistics and remain global.<br /> <br /> Reproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket<br /> binds 127.0.0.1:4242 in init_net as root. A child process enters<br /> a fresh user_ns plus netns and opens AF_RDS there, then calls<br /> getsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the<br /> child sees the init_net socket. After this change, the child<br /> sees zero entries.<br /> <br /> Drop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count<br /> globals. v2 used them for the size precheck and lens-&gt;nr; v3<br /> replaced the precheck with a per-ns count from a first pass over<br /> the list, so the globals have no remaining readers. The matching<br /> increments and decrements in rds_create()/rds_destroy_sock() and<br /> rds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with<br /> them. Reported by the kernel test robot under clang W=1.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: purge async notifications upon nic error<br /> <br /> This fixes a kernel panic in reconfig failure:<br /> <br /> 1. we have a BSS connection<br /> 2. we have a NAN connection<br /> 3. FW error occurs<br /> 4. reconfig restores the BSS connection<br /> 5. however, restoring the NAN connection fails due to a FW error.<br /> 6. erroneously, ieee80211_handle_reconfig_failure is called and marks all<br /> interfaces as not-in-driver (will be fixed in a different patch).<br /> 7. mac80211 frees the links of the BSS connection but doesn&amp;#39;t tell the<br /> driver about that, as it thinks that this vif is not in the driver.<br /> 8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed<br /> (erroneously?)<br /> 9. Therefore, async_handlers_wk is being executed, processing the<br /> statistics notification that was received after we restored the BSS<br /> connection.<br /> 10. the notification handler dereferences fw_id_to_bss_conf[id], which is<br /> now a dangling pointer, as mac80211 already freed this link in (7).<br /> 11. On the first access to one of the links fields, we panic.<br /> <br /> While this can and should be fixed by removing the call to<br /> ieee80211_handle_reconfig_failure in (6), it is also not a good idea to<br /> carry and maybe handle notifications from a dead FW.<br /> <br /> We do purge the notifications when we stop the FW, but in reconfig<br /> failure we stop the FW too late, after the notifications are processed.<br /> In addition, async_handlers_wk can always be scheduled before the<br /> reconfig work.<br /> <br /> Purge the notifications immediately when transport notifies about a nic<br /> error.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: Add package limit checks in parser functions<br /> <br /> Add package limit checks in parser functions to prevent out-of-bounds<br /> access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: validate byte_count in acpi_ps_get_next_package_length()<br /> <br /> Validate package length reading in acpi_ps_get_next_package_length().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: Add validation for node in acpi_ns_build_normalized_path()<br /> <br /> Add validation for node in acpi_ns_build_normalized_path()<br /> to prevent use-after-free vulnerabilities.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: validate handler object type in two places<br /> <br /> ACPICA: validate handler object type in acpi_ev_has_default_handler()<br /> and acpi_ev_find_region_handler().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)<br /> <br /> Add overflow check for Index + Length to prevent integer overflow<br /> when calculating the truncation length. This prevents negative<br /> size parameter being passed to memcpy().