Vulnerabilidades

*** Pendiente de traducción *** sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.

*** Pendiente de traducción *** Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.

*** Pendiente de traducción *** Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.<br /> <br /> The size guard &amp;#39;Elixir.Bandit.WebSocket.Connection&amp;#39;:oversize_message?/2 called from handle_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames.<br /> <br /> The max_fragmented_message_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback.<br /> <br /> This issue affects bandit: from 1.11.0 before 1.12.1.

*** Pendiente de traducción *** Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter(&amp;#39;system&amp;#39;) into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> kernel/fork: clear PF_BLOCK_TS in copy_process()<br /> <br /> PF_BLOCK_TS is only set in blk_time_get_ns() when current-&gt;plug is<br /> non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()<br /> before NULLing the plug pointer. copy_process() breaks the<br /> invariant by inheriting PF_BLOCK_TS from the parent while resetting<br /> the child&amp;#39;s plug to NULL.<br /> <br /> Clear PF_BLOCK_TS alongside that assignment so callers can rely on<br /> "PF_BLOCK_TS set implies current-&gt;plug != NULL" and dereference<br /> current-&gt;plug unguarded.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR<br /> <br /> When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown<br /> path ends up calling pci_iounmap() on the same iomem with some offset,<br /> which is unnecessary and triggers a kernel warning like the following:<br /> <br /> Trying to vunmap() nonexistent vm area (0000000069a5ffe8)<br /> WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937<br /> [...]<br /> Call trace:<br /> vunmap+0x58/0x68 (P)<br /> iounmap+0x34/0x48<br /> pci_iounmap+0x2c/0x40<br /> ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]<br /> pci_device_remove+0x48/0xf8<br /> device_remove+0x50/0x88<br /> device_release_driver_internal+0x1c8/0x228<br /> driver_detach+0x50/0xb0<br /> bus_remove_driver+0x74/0x100<br /> driver_unregister+0x34/0x68<br /> pci_unregister_driver+0x34/0xa0<br /> ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]<br /> [...]<br /> <br /> Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers<br /> <br /> Three BA session handlers use ffs(ba_data-&gt;sta_mask) - 1 to derive a<br /> station ID without checking that sta_mask is non-zero. When sta_mask is<br /> zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing<br /> an out-of-bounds access on fw_id_to_link_sta[].<br /> <br /> Add WARN_ON_ONCE(!ba_data-&gt;sta_mask) guards before each ffs() call,<br /> consistent with the existing check in iwl_mld_ampdu_rx_start().

*** Pendiente de traducción *** Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user&amp;#39;s session queue, causing the background drainer to forward malicious messages to the victim&amp;#39;s running AI agent with the victim&amp;#39;s credentials and permissions.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()<br /> <br /> Move of_node_put(dn) after the of_match_node() call, which still needs<br /> the node pointer. The node reference is correctly released after use.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: x86: hyper-v: Bound the bank index when querying sparse banks<br /> <br /> When checking if a VP ID is included in a sparse bank set, explicitly check<br /> that the ID can actually be contained in a sparse bank (the TLFS allows for<br /> a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB<br /> flush for L2, the VP ID is copied verbatim from the enlightened VMCS,<br /> without any bounds check, i.e. isn&amp;#39;t guaranteed to be under the limit of<br /> 4096.<br /> <br /> Failure to check the bounds of the VP ID leads to an out-of-bounds read<br /> when testing the sparse bank, and super strictly speaking could lead to KVM<br /> performing an unnecessary TLB flush for an L2 vCPU.<br /> <br /> ==================================================================<br /> BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm]<br /> Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802<br /> <br /> CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x51/0x60<br /> print_report+0xcb/0x5d0<br /> kasan_report+0xb4/0xe0<br /> kasan_check_range+0x35/0x1b0<br /> hv_is_vp_in_sparse_set+0x85/0x100 [kvm]<br /> kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm]<br /> kvm_hv_hypercall+0xe6b/0x1e60 [kvm]<br /> vmx_handle_exit+0x485/0x1b60 [kvm_intel]<br /> kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm]<br /> kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm]<br /> __x64_sys_ioctl+0x129/0x1a0<br /> do_syscall_64+0xb9/0xcf0<br /> entry_SYSCALL_64_after_hwframe+0x4b/0x53<br /> RIP: 0033:0x7f0e62d1a9bf<br /> <br /> <br /> The buggy address belongs to the physical page:<br /> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f<br /> flags: 0x4000000000000000(zone=1)<br /> raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000<br /> raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000<br /> page dumped because: kasan: bad access detected<br /> <br /> Memory state around the buggy address:<br /> ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> &gt;ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ^<br /> ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br /> ==================================================================<br /> Disabling lock debugging due to kernel taint<br /> <br /> Opportunistically add a compile time assertion to ensure the maximum number<br /> of sparse banks exactly matches the number of possible bits in the passed<br /> in mask.<br /> <br /> [sean: add KASAN splat, drop comment, add assert, massage changelog]

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> MIPS: smp: report dying CPU to RCU in stop_this_cpu()<br /> <br /> smp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function<br /> marks the CPU offline for the scheduler via set_cpu_online(false) but<br /> never informs RCU, so RCU keeps expecting a quiescent state from CPUs<br /> that are now spinning forever with interrupts disabled.<br /> <br /> As long as nothing waits for an RCU grace period after smp_send_stop()<br /> this is harmless, which is why it went unnoticed. Since commit<br /> 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT")<br /> however, irq_work_sync() calls synchronize_rcu() on architectures without<br /> an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns<br /> false. That is the asm-generic default used by MIPS. Any irq_work_sync()<br /> issued in the reboot/shutdown path after smp_send_stop() then blocks on<br /> a grace period that can never complete, hanging the reboot:<br /> <br /> WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on<br /> ...<br /> rcu: INFO: rcu_sched detected stalls on CPUs/tasks:<br /> rcu: Offline CPU 1 blocking current GP.<br /> rcu: Offline CPU 2 blocking current GP.<br /> rcu: Offline CPU 3 blocking current GP.<br /> <br /> This issue was noticed on several Realtek MIPS switch SoCs (MIPS<br /> interAptiv) and came up during kernel bump downstream in OpenWrt from<br /> 6.18.33 to 6.18.34, after the backport of the patch to the 6.18 stable<br /> branch. The patch also has been backported all the way back to 6.1.<br /> <br /> Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring the<br /> generic CPU-hotplug offline path, so RCU stops waiting on the parked CPUs<br /> and grace periods can still complete. MIPS shuts down all CPUs here<br /> without going through the CPU-hotplug mechanism, so this report is not<br /> otherwise issued. Reporting a dying CPU to RCU outside the regular hotplug<br /> offline path is not unprecedented: arm64 does the same in cpu_die_early().<br /> There it is an exception for a CPU that was coming online and is aborting<br /> bringup, rather than the default shutdown action as on MIPS.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fpga: region: fix use-after-free in child_regions_with_firmware()<br /> <br /> Move of_node_put(child_region) after the error print to avoid accessing<br /> freed memory when pr_err() references child_region.<br /> <br /> [ Yilun: Fix the Fixes tag ]