Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfs: ensure sb-&gt;s_fs_info is always cleaned up<br /> <br /> When hfs was converted to the new mount api a bug was introduced by<br /> changing the allocation pattern of sb-&gt;s_fs_info. If setup_bdev_super()<br /> fails after a new superblock has been allocated by sget_fc(), but before<br /> hfs_fill_super() takes ownership of the filesystem-specific s_fs_info<br /> data it was leaked.<br /> <br /> Fix this by freeing sb-&gt;s_fs_info in hfs_kill_super().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()<br /> <br /> rtw_core_enable_beacon() reads 4 bytes from an address that is not a<br /> multiple of 4. This results in a crash on some systems.<br /> <br /> Do 1 byte reads/writes instead.<br /> <br /> Unable to handle kernel paging request at virtual address ffff8000827e0522<br /> Mem abort info:<br /> ESR = 0x0000000096000021<br /> EC = 0x25: DABT (current EL), IL = 32 bits<br /> SET = 0, FnV = 0<br /> EA = 0, S1PTW = 0<br /> FSC = 0x21: alignment fault<br /> Data abort info:<br /> ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000<br /> CM = 0, WnR = 0, TnD = 0, TagAccess = 0<br /> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0<br /> swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000<br /> [ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13<br /> Internal error: Oops: 0000000096000021 [#1] SMP<br /> Modules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...]<br /> CPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G W 6.17.9 #1-NixOS VOLUNTARY<br /> Tainted: [W]=WARN<br /> Hardware name: FriendlyElec NanoPC-T6 LTS (DT)<br /> Workqueue: phy0 rtw_c2h_work [rtw88_core]<br /> pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : rtw_pci_read32+0x18/0x40 [rtw88_pci]<br /> lr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core]<br /> sp : ffff800080cc3ca0<br /> x29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828<br /> x26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00<br /> x23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001<br /> x20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000<br /> x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000<br /> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000<br /> x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090<br /> x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000<br /> x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000<br /> x2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522<br /> Call trace:<br /> rtw_pci_read32+0x18/0x40 [rtw88_pci] (P)<br /> rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core]<br /> rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core]<br /> rtw_c2h_work+0x50/0x98 [rtw88_core]<br /> process_one_work+0x178/0x3f8<br /> worker_thread+0x208/0x418<br /> kthread+0x120/0x220<br /> ret_from_fork+0x10/0x20<br /> Code: d28fe202 8b020000 f9524400 8b214000 (b9400000)<br /> ---[ end trace 0000000000000000 ]---

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate nesting depth during parsing operations, allowing authenticated attackers to trigger denial of service conditions by uploading deeply nested malicious files. This results in CPU exhaustion, service degradation, or complete service unavailability.

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. <br /> <br /> The vulnerability could lead to remote code execution, denial of service, or privilege escalation.<br /> <br /> This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_info.hpp. This manipulation causes use after free. The attack requires local access. The attack&amp;#39;s complexity is rated as high. The exploitability is reported as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single<br /> <br /> When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the following warning<br /> may be noticed:<br /> <br /> [ 3959.023862] ------------[ cut here ]------------<br /> [ 3959.023891] alloc_tag was not cleared (got tag for lib/xarray.c:378)<br /> [ 3959.023947] WARNING: ./include/linux/alloc_tag.h:155 at alloc_tag_add+0x128/0x178, CPU#6: mkfs.ntfs/113998<br /> [ 3959.023978] Modules linked in: dns_resolver tun brd overlay exfat btrfs blake2b libblake2b xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink sr_mod virtio_gpu cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper ghash_ce drm sm4 backlight virtio_net net_failover virtio_scsi failover virtio_console virtio_blk virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod i2c_dev aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject]<br /> [ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary)<br /> [ 3959.024182] Tainted: [W]=WARN<br /> [ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022<br /> [ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 3959.024199] pc : alloc_tag_add+0x128/0x178<br /> [ 3959.024207] lr : alloc_tag_add+0x128/0x178<br /> [ 3959.024214] sp : ffff80008b696d60<br /> [ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240<br /> [ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860<br /> [ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0<br /> [ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000<br /> [ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000<br /> [ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293<br /> [ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000<br /> [ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001<br /> [ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838<br /> [ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640<br /> [ 3959.024340] Call trace:<br /> [ 3959.024346] alloc_tag_add+0x128/0x178 (P)<br /> [ 3959.024355] __alloc_tagging_slab_alloc_hook+0x11c/0x1a8<br /> [ 3959.024362] kmem_cache_alloc_lru_noprof+0x1b8/0x5e8<br /> [ 3959.024369] xas_alloc+0x304/0x4f0<br /> [ 3959.024381] xas_create+0x1e0/0x4a0<br /> [ 3959.024388] xas_store+0x68/0xda8<br /> [ 3959.024395] __filemap_add_folio+0x5b0/0xbd8<br /> [ 3959.024409] filemap_add_folio+0x16c/0x7e0<br /> [ 3959.024416] __filemap_get_folio_mpol+0x2dc/0x9e8<br /> [ 3959.024424] iomap_get_folio+0xfc/0x180<br /> [ 3959.024435] __iomap_get_folio+0x2f8/0x4b8<br /> [ 3959.024441] iomap_write_begin+0x198/0xc18<br /> [ 3959.024448] iomap_write_iter+0x2ec/0x8f8<br /> [ 3959.024454] iomap_file_buffered_write+0x19c/0x290<br /> [ 3959.024461] blkdev_write_iter+0x38c/0x978<br /> [ 3959.024470] vfs_write+0x4d4/0x928<br /> [ 3959.024482] ksys_write+0xfc/0x1f8<br /> [ 3959.024489] __arm64_sys_write+0x74/0xb0<br /> [ 3959.024496] invoke_syscall+0xd4/0x258<br /> [ 3959.024507] el0_svc_common.constprop.0+0xb4/0x240<br /> [ 3959.024514] do_el0_svc+0x48/0x68<br /> [ 3959.024520] el0_svc+0x40/0xf8<br /> [ 3959.024526] el0t_64_sync_handler+0xa0/0xe8<br /> [ 3959.024533] el0t_64_sync+0x1ac/0x1b0<br /> [ 3959.024540] ---[ end trace 0000000000000000 ]---<br /> <br /> When __memcg_slab_post_alloc_hook() fails, there are two different<br /> free paths depending on whether size == 1 or size != 1. In the<br /> kmem_cache_free_bulk() path, we do call alloc_tagging_slab_free_hook().<br /> However, in memcg_alloc_abort_single() we don&amp;#39;t, the above warning will be<br /> triggered on the next allocation.<br /> <br /> Therefore, add alloc_tagging_slab_free_hook() to the<br /> memcg_alloc_abort_single() path.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()<br /> <br /> Fix incorrect NULL check in loongson_gpio_init_irqchip().<br /> The function checks chip-&gt;parent instead of chip-&gt;irq.parents.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> riscv: trace: fix snapshot deadlock with sbi ecall<br /> <br /> If sbi_ecall.c&amp;#39;s functions are traceable,<br /> <br /> echo "__sbi_ecall:snapshot" &gt; /sys/kernel/tracing/set_ftrace_filter<br /> <br /> may get the kernel into a deadlock.<br /> <br /> (Functions in sbi_ecall.c are excluded from tracing if<br /> CONFIG_RISCV_ALTERNATIVE_EARLY is set.)<br /> <br /> __sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code<br /> raises an IPI interrupt, which results in another call to __sbi_ecall<br /> and another snapshot...<br /> <br /> All it takes to get into this endless loop is one initial __sbi_ecall.<br /> On RISC-V systems without SSTC extension, the clock events in<br /> timer-riscv.c issue periodic sbi ecalls, making the problem easy to<br /> trigger.<br /> <br /> Always exclude the sbi_ecall.c functions from tracing to fix the<br /> potential deadlock.<br /> <br /> sbi ecalls can easiliy be logged via trace events, excluding ecall<br /> functions from function tracing is not a big limitation.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()<br /> <br /> In iscsit_dec_conn_usage_count(), the function calls complete() while<br /> holding the conn-&gt;conn_usage_lock. As soon as complete() is invoked, the<br /> waiter (such as iscsit_close_connection()) may wake up and proceed to free<br /> the iscsit_conn structure.<br /> <br /> If the waiter frees the memory before the current thread reaches<br /> spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function<br /> attempts to release a lock within the already-freed connection structure.<br /> <br /> Fix this by releasing the spinlock before calling complete().