Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: end fuse_req on io-uring cancel task work<br /> <br /> When io_uring delivers task work with tw.cancel set (PF_EXITING,<br /> PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context),<br /> fuse_uring_send_in_task() takes the cancel branch, assigns<br /> -ECANCELED, and falls through to fuse_uring_send(). That path only<br /> flips the entry to FRRS_USERSPACE and completes the io_uring cmd;<br /> it never discharges the ring entry&amp;#39;s owning reference to the<br /> fuse_req that fuse_uring_add_req_to_ring_ent() handed it at<br /> dispatch time.<br /> <br /> fuse_uring_send_in_task()<br /> tw.cancel == true<br /> err = -ECANCELED<br /> fuse_uring_send(ent, cmd, err, issue_flags)<br /> ent-&gt;state = FRRS_USERSPACE<br /> list_move(&amp;ent-&gt;list, &amp;queue-&gt;ent_in_userspace)<br /> ent-&gt;cmd = NULL<br /> io_uring_cmd_done(-ECANCELED)<br /> /* ent-&gt;fuse_req still set, req still hashed */<br /> <br /> The fuse_req stays linked on fpq-&gt;processing[hash] and<br /> fuse_request_end() is never invoked. The originating syscall<br /> thread blocks in D-state in request_wait_answer() until<br /> fuse_abort_conn() runs, which can be the entire connection<br /> lifetime. For FR_BACKGROUND requests fc-&gt;num_background is never<br /> decremented either, so repeated cancels inflate the counter until<br /> max_background is hit and all later background ops stall. tw.cancel does<br /> not imply a connection abort (e.g. a single io_uring worker thread exits<br /> while the fuse connection stays up), so this cannot be left for<br /> fuse_abort_conn() to clean up.<br /> <br /> Ending the req but still routing the entry through fuse_uring_send()<br /> is not enough: that leaves a req-less entry on ent_in_userspace, and<br /> ent_list_request_expired() dereferences ent-&gt;fuse_req unconditionally<br /> on the head of that list, which would then NULL-deref.<br /> <br /> Fix the cancel branch to release the entry directly. Remove it from the<br /> queue, complete the io_uring cmd, end the fuse_req, free the entry, and<br /> drop its queue_refs (waking the teardown waiter if it was the last).

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: fix moving cancelled entry to ent_in_userspace list<br /> <br /> fuse_uring_cancel() moves entries that are available (these have no reqs<br /> attached) to the ent_in_userspace list. ent_list_request_expired()<br /> checks the first entry on ent_in_userspace and dereferences<br /> ent-&gt;fuse_req unconditionally, which will crash on a cancelled entry<br /> that was moved to this list.<br /> <br /> Fix this by freeing the entry and dropping queue_refs directly in<br /> fuse_uring_cancel(). This is safe because cancel is the cancel handler<br /> itself - after io_uring_cmd_done(), no more cancels will be dispatched<br /> for this command, and teardown serializes with cancel via queue-&gt;lock.<br /> <br /> Since cancel now decrements queue_refs, fuse_uring_abort() must no<br /> longer gate fuse_uring_abort_end_requests() on queue_refs &gt; 0, as<br /> cancelled entries may have already dropped queue_refs while requests are<br /> still queued. Remove the gate so abort always flushes requests and stops<br /> queues.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: fix EFAULT clobber in fuse_uring_commit<br /> <br /> copy_from_user() returns the number of bytes not copied as an unsigned<br /> residual on failure (1..sizeof(struct fuse_out_header)). fuse_uring_commit<br /> stores that residual in ssize_t err, sets req-&gt;out.h.error to -EFAULT,<br /> then jumps to out: with err still holding the positive residual.<br /> <br /> err = copy_from_user(&amp;req-&gt;out.h, &amp;ent-&gt;headers-&gt;in_out,<br /> sizeof(req-&gt;out.h));<br /> if (err) {<br /> req-&gt;out.h.error = -EFAULT;<br /> goto out; /* err is the positive residual */<br /> }<br /> ...<br /> out:<br /> fuse_uring_req_end(ent, req, err);<br /> <br /> fuse_uring_req_end() then runs<br /> <br /> if (error)<br /> req-&gt;out.h.error = error;<br /> <br /> which overwrites the just-assigned -EFAULT with the positive residual.<br /> FUSE callers such as fuse_simple_request() test err out.args.<br /> <br /> Fix by assigning err = -EFAULT in the failure branch before jumping<br /> to out, so fuse_uring_req_end() receives a negative errno and sets<br /> req-&gt;out.h.error to -EFAULT.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req<br /> <br /> When fuse_resend() moves a request from fpq-&gt;processing back to<br /> fiq-&gt;pending, it sets FR_PENDING and clears FR_SENT but does not<br /> remove the requests intr_entry from fiq-&gt;interrupts. If the<br /> request had FR_INTERRUPTED set from a prior signal, intr_entry<br /> remains dangling on fiq-&gt;interrupts. When the requesting task<br /> then receives a fatal signal, fuse_remove_pending_req() sees<br /> FR_PENDING=1, removes the request from fiq-&gt;pending and frees it<br /> via the refcount path, also without cleaning intr_entry. The<br /> stale intr_entry causes use-after-free when fuse_read_interrupt()<br /> iterates fiq-&gt;interrupts:<br /> - list_del_init(&amp;req-&gt;intr_entry) -&gt; UAF write on freed slab<br /> - req-&gt;in.h.unique -&gt; UAF read, data leaked to userspace<br /> <br /> Remove intr_entry from fiq-&gt;interrupts in fuse_resend() for<br /> interrupted requests before they are placed back on fiq-&gt;pending.<br /> <br /> Add a WARN_ON if the intr_entry is not empty on request destruction.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: re-lock request before returning from fuse_ref_folio()<br /> <br /> fuse_ref_folio() unlocks the request but does not re-lock it before<br /> returning. fuse_chan_abort() can end the request and the async end<br /> callback (eg fuse_writepage_free()) can free the args while the<br /> subsequent copy chain logic after fuse_ref_folio() accesses them,<br /> leading to use-after-free issues.<br /> <br /> Fix this by locking the request in fuse_ref_folio() before returning.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: avoid 32-bit prune notification count wrap<br /> <br /> FUSE_NOTIFY_PRUNE validates the nodeid payload length with:<br /> <br /> size - sizeof(outarg) != outarg.count * sizeof(u64)<br /> <br /> On 32-bit kernels, size_t is also 32 bits, so the daemon-controlled<br /> count multiplication can wrap. A prune notification with count<br /> 0x20000000 and no nodeid payload passes the check, enters the copy<br /> loop, and asks the device copy path to read nodeids that are not<br /> present in the userspace write buffer. In QEMU this reaches the<br /> fuse_copy_fill() BUG_ON(!err) path.<br /> <br /> Validate the payload length with array_size() instead. That accepts<br /> exactly the same valid messages, but avoids wrapping arithmetic before<br /> the copy loop consumes the count.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: reject overlapping data areas in SMB2 responses<br /> <br /> Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to<br /> responses without data area") restricted the implied bcc[0] length<br /> exception to responses without a data area. However, the overlap<br /> handling in __smb2_calc_size() clears data_length, which can make an<br /> invalid response appear to have no data area and so qualify for the<br /> exception.<br /> <br /> Track data area overlap separately and reject such responses before<br /> applying the length compatibility exceptions.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref<br /> <br /> If a copy into the userspace ring buffer fails, a request will be<br /> terminated and fuse_uring_req_end() will set ent-&gt;fuse_req to NULL but<br /> it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This<br /> can lead to a NULL deref if the request expiration logic scans<br /> ent_w_req_queue in the window before the entry is moved off it.<br /> <br /> Fix this by taking the entry off ent_w_req_queue and changing its state<br /> from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: don&amp;#39;t wrap around quota ids in dqiterate<br /> <br /> LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens<br /> to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot<br /> for ID_MAX, then this addition will truncate to zero and the iteration<br /> starts over. Fix this by casting to u64.

*** Pendiente de traducción *** Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.<br /> <br /> Options are passed directly to the wkhtmltopdf command without sanitization.<br /> <br /> Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection.<br /> <br /> Version 0.6.0 was released with an incomplete fix for this issue.<br /> <br /> Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.

*** Pendiente de traducción *** The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the &amp;#39;thwcfe_legacy_file&amp;#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

*** Pendiente de traducción *** The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.