Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Fix folio_queue ENOMEM in writeback by adding a mempool<br /> <br /> Fix the handling of folio_queue allocation failure in writeback by adding a<br /> mempool and passing in gfp_t flags to the rolling buffer functions that<br /> allocate memory, using the mempool if gfp != GFP_KERNEL.<br /> <br /> This is then extended upwards and the gfp to be used for a request is stored<br /> in the netfs_io_request struct and is then used for both requests and<br /> subrequests, eliminating the sleeping loops there.<br /> <br /> The failure caused:<br /> <br /> folio != NULL<br /> WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()<br /> <br /> syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.<br /> <br /> When device registration fails (e.g. in register_netdevice()), netdev core<br /> unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued<br /> during NETDEV_REGISTER (utn-&gt;work_pending is set), udp_tunnel_nic_unregister()<br /> returns early:<br /> <br /> if (utn-&gt;work_pending)<br /> return;<br /> <br /> Because failed registrations do not enter netdev_wait_allrefs_any(), no<br /> subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the<br /> struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked<br /> permanently.<br /> <br /> Fix this by removing the early return. Instead, synchronously cancel any<br /> pending work with cancel_delayed_work_sync() before freeing @utn.<br /> <br /> To be able to call cancel_delayed_work_sync() while holding RTNL (the work also<br /> needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL<br /> is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work())<br /> to prevent high CPU contention while waiting for RTNL lock.<br /> <br /> The utn-&gt;work_pending bookkeeping is no longer needed and is removed, as<br /> the workqueue core already tracks the pending/running state of the work.<br /> <br /> [1]<br /> BUG: memory leak<br /> unreferenced object 0xffff888127d5f840 (size 96):<br /> comm "syz-executor", pid 5806, jiffies 4294942188<br /> backtrace (crc 99fdb6c8):<br /> __kmalloc_noprof+0x3bf/0x550<br /> udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]<br /> udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]<br /> udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931<br /> notifier_call_chain+0x59/0x160 kernel/notifier.c:85<br /> call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250<br /> register_netdevice+0xc10/0xeb0 net/core/dev.c:11478

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds<br /> <br /> u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,<br /> 0-255) into the kernel knode object without bounds validation. When a<br /> packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates<br /> `ntohs(offmask &amp; *data) &gt;&gt; offshift` where the left operand is a 16-bit<br /> value promoted to a 32-bit int. Any offshift &gt;= 32 is undefined behavior<br /> per C11 6.5.7p3, triggerable by an unprivileged user via user/network<br /> namespaces.<br /> <br /> UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43<br /> shift exponent 32 is too large for 32-bit type int<br /> <br /> Fix this by rejecting offshift &gt;= 16 during filter creation in<br /> u32_change().

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rtase: fix double free of multi-frag skb on DMA map failure<br /> <br /> In rtase_start_xmit(), when the head buffer DMA mapping fails after<br /> rtase_xmit_frags() has mapped all fragments, the error path clears<br /> the fragment descriptors with rtase_tx_clear_range(), which frees<br /> the skb through the last-frag slot and accounts tx_dropped. Control<br /> then falls through to the common error label, which frees the same<br /> skb a second time and counts it again.<br /> <br /> Return right after clearing the fragments when the skb owns frags;<br /> the no-frag case still drops through and frees the head skb once.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read<br /> <br /> If the fan data becomes 0 between the FAN_DATA_VALID() check and the<br /> FAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash<br /> due to a race with a concurrent update of the cached fan value.<br /> <br /> Fix a TOCTOU issue by reading fan data once.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_sync: hold conn in hci_past_sync() callback<br /> <br /> Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have<br /> reused.<br /> <br /> Hold refcount to avoid that.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback<br /> <br /> There is theoretical UAF if the conn is freed while the hci_sync task is<br /> running.<br /> <br /> Hold refcount to avoid that.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback<br /> <br /> There is theoretical UAF if the conn is freed while the hci_sync task is<br /> running.<br /> <br /> Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to<br /> match the previous behavior.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_conn: hold conn reference in abort_conn_sync()<br /> <br /> There is theoretical UAF if the conn is freed while the hci_sync task is<br /> running.<br /> <br /> Hold refcount to avoid that.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btintel: Validate length before parsing diagnostics TLV<br /> <br /> btintel_diagnostics() accesses tlv-&gt;val[0] without first validating<br /> that the diagnostics VSE is long enough to contain that field, so<br /> may cause reading data beyond the received frame.<br /> <br /> Fix by validating the length before access.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero<br /> <br /> hci_conn::iso_data is accessed and modified without lock or RCU.<br /> This leads to a race<br /> <br /> [Task hdev-&gt;workqueue] [Task 2]<br /> iso_recv iso_conn_put(conn)<br /> conn = LOAD hcon-&gt;iso_data iso_conn_free(conn)<br /> iso_conn_hold_unless_zero(conn) hcon-&gt;iso_data = NULL<br /> kfree(conn)<br /> kref_get_unless_zero(&amp;conn-&gt;ref) /* UAF */<br /> <br /> and also to races in iso_conn_add() vs. iso_conn_free().<br /> <br /> Fix by adding spinlock hci_conn::proto_lock and using it to guard<br /> hci_conn::iso_data.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: fix refcounting of iso_conn<br /> <br /> iso_conn_del() and iso_chan_del() have a race that results to double-put<br /> of iso_conn:<br /> <br /> [Task hdev-&gt;workqueue] [Task 2]<br /> iso_conn_del iso_chan_del<br /> iso_conn_hold_unless_zero iso_conn_lock<br /> iso_conn_lock conn-&gt;sk = NULL<br /> iso_conn_unlock<br /> sk = iso_sock_hold(conn) conn own refcount when non-NULL, so<br /> iso_conn_del does not need to put it. Adjust the iso_conn_add()<br /> refcounting so that conn is put if it does not get associated with an<br /> sk.