Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: reject mapping a reserved doorbell to a new queue<br /> <br /> When creating an user-queue, the user space<br /> provides a doorbell BO handle and an offset within<br /> the bo to obtain a doorbell.<br /> <br /> However current implementation using xa_store_irq()<br /> to store a doorbell, which allows a later queue created<br /> with the same BO and offset parameters to overwrite an<br /> existing queue and doorbell mapping.<br /> <br /> This can cause problems like misrouting fence IRQ<br /> processing to a wrong queue, and mislead the cleanup<br /> process of one queue erasing the mapping of another queue.<br /> <br /> This commit fixes this issue by replacing xa_store_irq with<br /> xa_insert_irq, which rejects mapping a reserved<br /> doorbell to a newly created queue<br /> <br /> (cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e)

*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sched_ext: Preserve rq tracking across local DSQ dispatch<br /> <br /> dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while<br /> ops.dispatch() has recorded the current rq. Moving a task to a local DSQ<br /> may switch to the source or destination rq before synchronously invoking<br /> ops.dequeue() through the following path:<br /> <br /> SCX_CALL_OP(dispatch, rq)<br /> ops.dispatch()<br /> scx_bpf_dsq_move_to_local()<br /> scx_flush_dispatch_buf()<br /> finish_dispatch()<br /> dispatch_to_local_dsq()<br /> scx_dispatch_enqueue()<br /> local_dsq_post_enq()<br /> call_task_dequeue()<br /> SCX_CALL_OP_TASK(dequeue, locked_rq, ...)<br /> <br /> The nested callback saves the recorded rq and restores it on return. If<br /> the rq tracking does not follow the lock switch, update_locked_rq() can<br /> trigger the following lockdep assertion while restoring an rq which is<br /> no longer held:<br /> <br /> WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170<br /> Call Trace:<br /> scx_dispatch_enqueue+0x2b0/0x460<br /> dispatch_to_local_dsq+0x138/0x230<br /> scx_flush_dispatch_buf+0x1af/0x220<br /> scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0<br /> bpf__sched_ext_ops_dispatch+0x4b/0xa7<br /> do_pick_task_scx+0x3b6/0x910<br /> __pick_next_task+0x105/0x1f0<br /> __schedule+0x3e7/0x1980<br /> <br /> Introduce switch_rq_lock() to update the tracking state together with<br /> each rq lock handoff. Use it in dispatch_to_local_dsq(),<br /> move_remote_task_to_local_dsq() and the in-balance paths of<br /> scx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the<br /> rq whose lock is actually held throughout the lock dance.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: fix race between registration and connection abortion<br /> <br /> This fixes this race:<br /> - thread a: io_uring_enter -&gt; register sqe -&gt;<br /> fuse_uring_create_ring_ent -&gt; allocate ent but doesn&amp;#39;t grab queue_ref<br /> yet<br /> - thread b: fuse_conn_destroy() -&gt; fuse_chan_abort() -&gt;<br /> fuse_uring_abort() is a no-op due to queue ref being 0<br /> - thread a: grabs the queue_ref, queue_ref is now 1, rest of<br /> fuse_uring_do_register() logic executes<br /> - thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs<br /> and calls<br /> "wait_event(ring-&gt;stop_waitq, atomic_read(&amp;ring-&gt;queue_refs) == 0);"<br /> The abort/unmount thread will hang indefinitely in unkillable state as<br /> nothing will decrement queue_refs or wake stop_waitq, and the ring,<br /> queue, and ent are leaked.<br /> <br /> Fix this by checking fch-&gt;connected under fch-&gt;lock after the created<br /> ent has grabbed a ref count on the queue. This ensures that in the<br /> scenario above, it is guaranteed that we either release the queue ref<br /> and wake up stop_waitq (in case fuse_chan_wait_aborted() is already<br /> waiting) in fuse_uring_do_register() when we detect !fch-&gt;connected, or<br /> if the connection is aborted after the check, it is guaranteed that the<br /> async teardown worker will be running in the background cleaning up ents<br /> and decrementing the ent&amp;#39;s ref on the queue, which will unblock the<br /> eventual queue and ring teardown.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> audit: fix recursive locking deadlock in audit_dupe_exe()<br /> <br /> A deadlock occurs in the audit subsystem when duplicating<br /> executable-related rules.<br /> <br /> When a file is moved (e.g., via do_renameat2()), the VFS layer locks<br /> the parent directory (I_MUTEX_PARENT), which synchronously triggers an<br /> fsnotify_move event. If an existing executable audit rule matches the<br /> file being moved, the audit subsystem catches this event and calls<br /> audit_dupe_exe() to duplicate the watch and update the rule. Then,<br /> audit_alloc_mark() would call kern_path_parent() to resolve the path,<br /> leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock<br /> already held by the task, resulting in the following recursive locking<br /> deadlock:<br /> <br /> ============================================<br /> WARNING: possible recursive locking detected<br /> 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted<br /> --------------------------------------------<br /> mv/5099 is trying to acquire lock:<br /> ffff888132845358 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1){+.+.}-{3:3},<br /> at: __kern_path_locked+0x10a/0x2f0<br /> <br /> but task is already holding lock:<br /> ffff888132846b58 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1){+.+.}-{3:3},<br /> at: lock_two_directories+0x13f/0x2b0<br /> <br /> other info that might help us debug this:<br /> Possible unsafe locking scenario:<br /> <br /> CPU0<br /> ----<br /> lock(&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1);<br /> lock(&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1);<br /> <br /> *** DEADLOCK ***<br /> <br /> May be due to missing lock nesting notation<br /> <br /> 6 locks held by mv/5099:<br /> #0: ffff888112a9c440 (sb_writers#13)<br /> at: do_renameat2+0x34c/0xbc0<br /> #1: ffff888112a9c790 (&amp;type-&gt;s_vfs_rename_key#3)<br /> at: do_renameat2+0x415/0xbc0<br /> #2: ffff888132846b58 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/1)<br /> at: lock_two_directories+0x13f/0x2b0<br /> #3: ffff888132845358 (&amp;inode-&gt;i_sb-&gt;s_type-&gt;i_mutex_dir_key/5)<br /> at: lock_two_directories+0x175/0x2b0<br /> #4: ffffffffb3a1fb10 (&amp;fsnotify_mark_srcu)<br /> at: fsnotify+0x454/0x28a0<br /> #5: ffffffffaf886230 (audit_filter_mutex)<br /> at: audit_update_watch+0x36/0x11e0<br /> <br /> stack backtrace:<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x6f/0xb0<br /> print_deadlock_bug.cold+0xbd/0xca<br /> validate_chain+0x83a/0xf00<br /> __lock_acquire+0xcac/0x1d20<br /> lock_acquire.part.0+0x11b/0x360<br /> down_write_nested+0x9f/0x230<br /> __kern_path_locked+0x10a/0x2f0<br /> kern_path_locked+0x26/0x40<br /> audit_alloc_mark+0xfb/0x4f0<br /> audit_dupe_exe+0x6c/0xe0<br /> audit_dupe_rule+0x6c2/0xc00<br /> audit_update_watch+0x4cc/0x11e0<br /> audit_watch_handle_event+0x12c/0x1b0<br /> send_to_group+0x5d0/0x8b0<br /> fsnotify+0x615/0x28a0<br /> fsnotify_move+0x1d8/0x630<br /> vfs_rename+0xdcd/0x1df0<br /> do_renameat2+0x9d4/0xbc0<br /> __x64_sys_renameat+0x192/0x260<br /> do_syscall_64+0x92/0x180<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7f0491fe8c4e<br /> Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff<br /> c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <br /> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89<br /> RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108<br /> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e<br /> RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001<br /> R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a<br /> R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c<br /> <br /> <br /> The aforementioned deadlock can be consistently reproduced by running<br /> the script below:<br /> <br /> audit-dupe-exe-deadlock.sh<br /> --------------------------<br /> #!/bin/bash<br /> auditctl -D<br /> mkdir -p /tmp/foo<br /> touch /tmp/file<br /> auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr<br /> mv /tmp/file /tmp/foo/file<br /> rm -Rf /tmp/foo<br /> <br /> This patch fixes the issue by introducing struct audit_watch_ctx to pass<br /> the fsnotify event context down to audit_alloc_mark(). By utilizing the<br /> already-resolved directory inode provided by the event, we bypass the<br /> kern_path_parent() path resol<br /> ---truncated---

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug<br /> <br /> If a vCPU stays scheduled out (or blocked) while the last pCPU it ran<br /> on goes through a hotplug cycle (online-&gt;offline-&gt;online), and the vCPU<br /> then resumes execution on the same pCPU, then it is possible for it to<br /> run with an ASID that has now been assigned to a different vCPU,<br /> resulting in stale TLB translations being used.<br /> <br /> svm_enable_virtualization_cpu() resets asid_generation to 1 and sets<br /> next_asid to max_asid + 1 on every CPU online event, including hotplug<br /> cycles. Because next_asid starts beyond the pool boundary, the first<br /> call to new_asid() after an online event always wraps the pool,<br /> incrementing asid_generation to 2 and assigning ASIDs starting from<br /> min_asid.<br /> <br /> Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding<br /> asid_generation=2 and ASID=N from before the hotplug event:<br /> <br /> 1. CPU-X goes offline and back online: asid_generation resets to 1,<br /> next_asid = max_asid + 1.<br /> <br /> 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping<br /> the pool and consuming ASIDs starting from min_asid. Eventually<br /> vCPU-B from a different VM is assigned asid_generation=2, ASID=N<br /> — the same ASID that vCPU-A held before the hotplug.<br /> <br /> 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-&gt;cpu is<br /> unchanged so the migration branch is skipped. Its saved<br /> asid_generation=2 matches sd-&gt;asid_generation=2, so the generation<br /> check silently passes and vCPU-A continues running with ASID=N —<br /> the same ASID just freshly assigned to vCPU-B.<br /> <br /> Both vCPUs from different VMs now run on CPU-X with the same ASID,<br /> causing them to share NPT TLB entries and producing stale translations.<br /> <br /> The collision manifests as a KVM internal error (Suberror: 1, emulation<br /> failure). The NPT page fault reports a faulting GPA far outside the<br /> VM&amp;#39;s physical memory range — a sign of stale TLB translations being<br /> used. KVM falls back to instruction emulation, which fails on<br /> FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not<br /> implement.<br /> <br /> Fix this by incrementing asid_generation instead of resetting it to 1<br /> in svm_enable_virtualization_cpu(). On module load, asid_generation<br /> starts at 0 (memset) and the increment produces 1, identical to the<br /> old behaviour. On subsequent hotplug cycles the generation advances<br /> beyond any value a vCPU previously observed on this CPU, so the<br /> generation check in pre_svm_run() reliably forces new_asid() on every<br /> vCPU after every hotplug cycle.

*** Pendiente de traducción *** Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

*** Pendiente de traducción *** A flaw was found in GIMP&amp;#39;s PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim&amp;#39;s system.

*** Pendiente de traducción *** entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service. <br /> <br /> <br /> This issue was fixed in commit 2467fe0

*** Pendiente de traducción *** A flaw was found in StackRox/RHACS Central&amp;#39;s Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.

*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

*** Pendiente de traducción *** Improper neutralization of special elements used in an OS command (&amp;#39;OS command injection&amp;#39;) vulnerability in Zyxel Networks WAH7601 allows OS Command Injection.<br /> <br /> This issue affects WAH7601: through 20072026.