Vulnerabilities

SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions

IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed this vulnerability in the latest update.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: soc-compress: Reposition and add pcm_mutex<br /> <br /> If panic_on_warn is set and compress stream(DPCM) is started,<br /> then kernel panic occurred because card-&gt;pcm_mutex isn&amp;#39;t held appropriately.<br /> In the following functions, warning were issued at this line<br /> "snd_soc_dpcm_mutex_assert_held".<br /> <br /> static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,<br /> struct snd_soc_pcm_runtime *be, int stream)<br /> {<br /> ...<br /> snd_soc_dpcm_mutex_assert_held(fe);<br /> ...<br /> }<br /> <br /> void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)<br /> {<br /> ...<br /> snd_soc_dpcm_mutex_assert_held(fe);<br /> ...<br /> }<br /> <br /> void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd,<br /> int stream, int action)<br /> {<br /> ...<br /> snd_soc_dpcm_mutex_assert_held(rtd);<br /> ...<br /> }<br /> <br /> int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir,<br /> int event)<br /> {<br /> ...<br /> snd_soc_dpcm_mutex_assert_held(fe);<br /> ...<br /> }<br /> <br /> These functions are called by soc_compr_set_params_fe, soc_compr_open_fe<br /> and soc_compr_free_fe<br /> without pcm_mutex locking. And this is call stack.<br /> <br /> [ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750<br /> [ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750<br /> [ 414.527945][ T2179] Call trace:<br /> [ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750<br /> [ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc<br /> [ 414.527972][ T2179] snd_compr_open+0x180/0x248<br /> [ 414.527981][ T2179] snd_open+0x15c/0x194<br /> [ 414.528003][ T2179] chrdev_open+0x1b0/0x220<br /> [ 414.528023][ T2179] do_dentry_open+0x30c/0x594<br /> [ 414.528045][ T2179] vfs_open+0x34/0x44<br /> [ 414.528053][ T2179] path_openat+0x914/0xb08<br /> [ 414.528062][ T2179] do_filp_open+0xc0/0x170<br /> [ 414.528068][ T2179] do_sys_openat2+0x94/0x18c<br /> [ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4<br /> [ 414.528084][ T2179] invoke_syscall+0x48/0x10c<br /> [ 414.528094][ T2179] el0_svc_common+0xbc/0x104<br /> [ 414.528099][ T2179] do_el0_svc+0x34/0xd8<br /> [ 414.528103][ T2179] el0_svc+0x34/0xc4<br /> [ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc<br /> [ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4<br /> [ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ...<br /> <br /> So, I reposition and add pcm_mutex to resolve lockdep error.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netlink: do not hard code device address lenth in fdb dumps<br /> <br /> syzbot reports that some netdev devices do not have a six bytes<br /> address [1]<br /> <br /> Replace ETH_ALEN by dev-&gt;addr_len.<br /> <br /> [1] (Case of a device where dev-&gt;addr_len = 4)<br /> <br /> BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]<br /> BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169<br /> instrument_copy_to_user include/linux/instrumented.h:114 [inline]<br /> copyout+0xb8/0x100 lib/iov_iter.c:169<br /> _copy_to_iter+0x6d8/0x1d00 lib/iov_iter.c:536<br /> copy_to_iter include/linux/uio.h:206 [inline]<br /> simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513<br /> __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419<br /> skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527<br /> skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]<br /> netlink_recvmsg+0x4ae/0x15a0 net/netlink/af_netlink.c:1970<br /> sock_recvmsg_nosec net/socket.c:1019 [inline]<br /> sock_recvmsg net/socket.c:1040 [inline]<br /> ____sys_recvmsg+0x283/0x7f0 net/socket.c:2722<br /> ___sys_recvmsg+0x223/0x840 net/socket.c:2764<br /> do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858<br /> __sys_recvmmsg net/socket.c:2937 [inline]<br /> __do_sys_recvmmsg net/socket.c:2960 [inline]<br /> __se_sys_recvmmsg net/socket.c:2953 [inline]<br /> __x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Uninit was stored to memory at:<br /> __nla_put lib/nlattr.c:1009 [inline]<br /> nla_put+0x1c6/0x230 lib/nlattr.c:1067<br /> nlmsg_populate_fdb_fill+0x2b8/0x600 net/core/rtnetlink.c:4071<br /> nlmsg_populate_fdb net/core/rtnetlink.c:4418 [inline]<br /> ndo_dflt_fdb_dump+0x616/0x840 net/core/rtnetlink.c:4456<br /> rtnl_fdb_dump+0x14ff/0x1fc0 net/core/rtnetlink.c:4629<br /> netlink_dump+0x9d1/0x1310 net/netlink/af_netlink.c:2268<br /> netlink_recvmsg+0xc5c/0x15a0 net/netlink/af_netlink.c:1995<br /> sock_recvmsg_nosec+0x7a/0x120 net/socket.c:1019<br /> ____sys_recvmsg+0x664/0x7f0 net/socket.c:2720<br /> ___sys_recvmsg+0x223/0x840 net/socket.c:2764<br /> do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858<br /> __sys_recvmmsg net/socket.c:2937 [inline]<br /> __do_sys_recvmmsg net/socket.c:2960 [inline]<br /> __se_sys_recvmmsg net/socket.c:2953 [inline]<br /> __x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Uninit was created at:<br /> slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716<br /> slab_alloc_node mm/slub.c:3451 [inline]<br /> __kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490<br /> kmalloc_trace+0x51/0x200 mm/slab_common.c:1057<br /> kmalloc include/linux/slab.h:559 [inline]<br /> __hw_addr_create net/core/dev_addr_lists.c:60 [inline]<br /> __hw_addr_add_ex+0x2e5/0x9e0 net/core/dev_addr_lists.c:118<br /> __dev_mc_add net/core/dev_addr_lists.c:867 [inline]<br /> dev_mc_add+0x9a/0x130 net/core/dev_addr_lists.c:885<br /> igmp6_group_added+0x267/0xbc0 net/ipv6/mcast.c:680<br /> ipv6_mc_up+0x296/0x3b0 net/ipv6/mcast.c:2754<br /> ipv6_mc_remap+0x1e/0x30 net/ipv6/mcast.c:2708<br /> addrconf_type_change net/ipv6/addrconf.c:3731 [inline]<br /> addrconf_notify+0x4d3/0x1d90 net/ipv6/addrconf.c:3699<br /> notifier_call_chain kernel/notifier.c:93 [inline]<br /> raw_notifier_call_chain+0xe4/0x430 kernel/notifier.c:461<br /> call_netdevice_notifiers_info net/core/dev.c:1935 [inline]<br /> call_netdevice_notifiers_extack net/core/dev.c:1973 [inline]<br /> call_netdevice_notifiers+0x1ee/0x2d0 net/core/dev.c:1987<br /> bond_enslave+0xccd/0x53f0 drivers/net/bonding/bond_main.c:1906<br /> do_set_master net/core/rtnetlink.c:2626 [inline]<br /> rtnl_newlink_create net/core/rtnetlink.c:3460 [inline]<br /> __rtnl_newlink net/core/rtnetlink.c:3660 [inline]<br /> rtnl_newlink+0x378c/0x40e0 net/core/rtnetlink.c:3673<br /> rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6395<br /> netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546<br /> rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6413<br /> netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]<br /> netlink_unicast+0xf28/0x1230 net/netlink/af_<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable()<br /> <br /> When disabling overlay plane in mxsfb_plane_overlay_atomic_update(),<br /> overlay plane&amp;#39;s framebuffer pointer is NULL. So, dereferencing it would<br /> cause a kernel Oops(NULL pointer dereferencing). Fix the issue by<br /> disabling overlay plane in mxsfb_plane_overlay_atomic_disable() instead.