Vulnerabilities

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.<br /> <br /> <br /> The entry process of the enforcer container is the monitor<br /> process. When the enforcer container stops, the monitor process checks <br /> whether the consul subprocess has exited. To perform this check, the <br /> monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.<br /> <br /> <br /> The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT<br /> are used directly to compose shell commands via popen without <br /> validation or sanitization. This behavior could allow a malicious user <br /> to inject malicious commands through these variables within the enforcer<br /> container.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: hda: Fix missing pointer check in hda_component_manager_init function<br /> <br /> The __component_match_add function may assign the &amp;#39;matchptr&amp;#39; pointer<br /> the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.<br /> <br /> The call stack leading to the error looks like this:<br /> <br /> hda_component_manager_init<br /> |-&gt; component_match_add<br /> |-&gt; component_match_add_release<br /> |-&gt; __component_match_add ( ... ,**matchptr, ... )<br /> |-&gt; *matchptr = ERR_PTR(-ENOMEM); // assign<br /> |-&gt; component_master_add_with_match( ... match)<br /> |-&gt; component_match_realloc(match, match-&gt;num); // dereference<br /> <br /> Add IS_ERR() check to prevent the crash.<br /> <br /> Found by Linux Verification Center (linuxtesting.org) with SVACE.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NFSD: Define a proc_layoutcommit for the FlexFiles layout type<br /> <br /> Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT<br /> operation on a FlexFiles layout.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()<br /> <br /> The hfsplus_strcasecmp() logic can trigger the issue:<br /> <br /> [ 117.317703][ T9855] ==================================================================<br /> [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplus_strcasecmp+0x1bc/0x490<br /> [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855<br /> [ 117.319577][ T9855]<br /> [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full)<br /> [ 117.319780][ T9855] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014<br /> [ 117.319783][ T9855] Call Trace:<br /> [ 117.319785][ T9855] <br /> [ 117.319788][ T9855] dump_stack_lvl+0x1c1/0x2a0<br /> [ 117.319795][ T9855] ? __virt_addr_valid+0x1c8/0x5c0<br /> [ 117.319803][ T9855] ? __pfx_dump_stack_lvl+0x10/0x10<br /> [ 117.319808][ T9855] ? rcu_is_watching+0x15/0xb0<br /> [ 117.319816][ T9855] ? lock_release+0x4b/0x3e0<br /> [ 117.319821][ T9855] ? __kasan_check_byte+0x12/0x40<br /> [ 117.319828][ T9855] ? __virt_addr_valid+0x1c8/0x5c0<br /> [ 117.319835][ T9855] ? __virt_addr_valid+0x4a5/0x5c0<br /> [ 117.319842][ T9855] print_report+0x17e/0x7e0<br /> [ 117.319848][ T9855] ? __virt_addr_valid+0x1c8/0x5c0<br /> [ 117.319855][ T9855] ? __virt_addr_valid+0x4a5/0x5c0<br /> [ 117.319862][ T9855] ? __phys_addr+0xd3/0x180<br /> [ 117.319869][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490<br /> [ 117.319876][ T9855] kasan_report+0x147/0x180<br /> [ 117.319882][ T9855] ? hfsplus_strcasecmp+0x1bc/0x490<br /> [ 117.319891][ T9855] hfsplus_strcasecmp+0x1bc/0x490<br /> [ 117.319900][ T9855] ? __pfx_hfsplus_cat_case_cmp_key+0x10/0x10<br /> [ 117.319906][ T9855] hfs_find_rec_by_key+0xa9/0x1e0<br /> [ 117.319913][ T9855] __hfsplus_brec_find+0x18e/0x470<br /> [ 117.319920][ T9855] ? __pfx_hfsplus_bnode_find+0x10/0x10<br /> [ 117.319926][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10<br /> [ 117.319933][ T9855] ? __pfx___hfsplus_brec_find+0x10/0x10<br /> [ 117.319942][ T9855] hfsplus_brec_find+0x28f/0x510<br /> [ 117.319949][ T9855] ? __pfx_hfs_find_rec_by_key+0x10/0x10<br /> [ 117.319956][ T9855] ? __pfx_hfsplus_brec_find+0x10/0x10<br /> [ 117.319963][ T9855] ? __kmalloc_noprof+0x2a9/0x510<br /> [ 117.319969][ T9855] ? hfsplus_find_init+0x8c/0x1d0<br /> [ 117.319976][ T9855] hfsplus_brec_read+0x2b/0x120<br /> [ 117.319983][ T9855] hfsplus_lookup+0x2aa/0x890<br /> [ 117.319990][ T9855] ? __pfx_hfsplus_lookup+0x10/0x10<br /> [ 117.320003][ T9855] ? d_alloc_parallel+0x2f0/0x15e0<br /> [ 117.320008][ T9855] ? __lock_acquire+0xaec/0xd80<br /> [ 117.320013][ T9855] ? __pfx_d_alloc_parallel+0x10/0x10<br /> [ 117.320019][ T9855] ? __raw_spin_lock_init+0x45/0x100<br /> [ 117.320026][ T9855] ? __init_waitqueue_head+0xa9/0x150<br /> [ 117.320034][ T9855] __lookup_slow+0x297/0x3d0<br /> [ 117.320039][ T9855] ? __pfx___lookup_slow+0x10/0x10<br /> [ 117.320045][ T9855] ? down_read+0x1ad/0x2e0<br /> [ 117.320055][ T9855] lookup_slow+0x53/0x70<br /> [ 117.320065][ T9855] walk_component+0x2f0/0x430<br /> [ 117.320073][ T9855] path_lookupat+0x169/0x440<br /> [ 117.320081][ T9855] filename_lookup+0x212/0x590<br /> [ 117.320089][ T9855] ? __pfx_filename_lookup+0x10/0x10<br /> [ 117.320098][ T9855] ? strncpy_from_user+0x150/0x290<br /> [ 117.320105][ T9855] ? getname_flags+0x1e5/0x540<br /> [ 117.320112][ T9855] user_path_at+0x3a/0x60<br /> [ 117.320117][ T9855] __x64_sys_umount+0xee/0x160<br /> [ 117.320123][ T9855] ? __pfx___x64_sys_umount+0x10/0x10<br /> [ 117.320129][ T9855] ? do_syscall_64+0xb7/0x3a0<br /> [ 117.320135][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> [ 117.320141][ T9855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> [ 117.320145][ T9855] do_syscall_64+0xf3/0x3a0<br /> [ 117.320150][ T9855] ? exc_page_fault+0x9f/0xf0<br /> [ 117.320154][ T9855] entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> [ 117.320158][ T9855] RIP: 0033:0x7f7dd7908b07<br /> [ 117.320163][ T9855] Code: 23 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 08<br /> [ 117.320167][ T9855] RSP: 002b:00007ffd5ebd9698 EFLAGS: 00000202 <br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cxl/features: Add check for no entries in cxl_feature_info<br /> <br /> cxl EDAC calls cxl_feature_info() to get the feature information and<br /> if the hardware has no Features support, cxlfs may be passed in as<br /> NULL.<br /> <br /> [ 51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008<br /> [ 51.965571] #PF: supervisor read access in kernel mode<br /> [ 51.971559] #PF: error_code(0x0000) - not-present page<br /> [ 51.977542] PGD 17e4f6067 P4D 0<br /> [ 51.981384] Oops: Oops: 0000 [#1] SMP NOPTI<br /> [ 51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj<br /> test+ #64 PREEMPT(voluntary)<br /> [ 51.997355] Hardware name: <br /> [ 52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core]<br /> <br /> Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if<br /> there is no cxlfs created due to no hardware support.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ixgbe: fix too early devlink_free() in ixgbe_remove()<br /> <br /> Since ixgbe_adapter is embedded in devlink, calling devlink_free()<br /> prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()<br /> to the end.<br /> <br /> KASAN report:<br /> <br /> BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]<br /> Read of size 8 at addr ffff0000adf813e0 by task bash/2095<br /> CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)<br /> [...]<br /> Call trace:<br /> show_stack+0x30/0x90 (C)<br /> dump_stack_lvl+0x9c/0xd0<br /> print_address_description.constprop.0+0x90/0x310<br /> print_report+0x104/0x1f0<br /> kasan_report+0x88/0x180<br /> __asan_report_load8_noabort+0x20/0x30<br /> ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]<br /> ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]<br /> ixgbe_remove+0x2d0/0x8c0 [ixgbe]<br /> pci_device_remove+0xa0/0x220<br /> device_remove+0xb8/0x170<br /> device_release_driver_internal+0x318/0x490<br /> device_driver_detach+0x40/0x68<br /> unbind_store+0xec/0x118<br /> drv_attr_store+0x64/0xb8<br /> sysfs_kf_write+0xcc/0x138<br /> kernfs_fop_write_iter+0x294/0x440<br /> new_sync_write+0x1fc/0x588<br /> vfs_write+0x480/0x6a0<br /> ksys_write+0xf0/0x1e0<br /> __arm64_sys_write+0x70/0xc0<br /> invoke_syscall.constprop.0+0xcc/0x280<br /> el0_svc_common.constprop.0+0xa8/0x248<br /> do_el0_svc+0x44/0x68<br /> el0_svc+0x54/0x160<br /> el0t_64_sync_handler+0xa0/0xe8<br /> el0t_64_sync+0x1b0/0x1b8

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_ncm: Refactor bind path to use __free()<br /> <br /> After an bind/unbind cycle, the ncm-&gt;notify_req is left stale. If a<br /> subsequent bind fails, the unified error label attempts to free this<br /> stale request, leading to a NULL pointer dereference when accessing<br /> ep-&gt;ops-&gt;free_request.<br /> <br /> Refactor the error handling in the bind path to use the __free()<br /> automatic cleanup mechanism.<br /> <br /> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020<br /> Call trace:<br /> usb_ep_free_request+0x2c/0xec<br /> ncm_bind+0x39c/0x3dc<br /> usb_add_function+0xcc/0x1f0<br /> configfs_composite_bind+0x468/0x588<br /> gadget_bind_driver+0x104/0x270<br /> really_probe+0x190/0x374<br /> __driver_probe_device+0xa0/0x12c<br /> driver_probe_device+0x3c/0x218<br /> __device_attach_driver+0x14c/0x188<br /> bus_for_each_drv+0x10c/0x168<br /> __device_attach+0xfc/0x198<br /> device_initial_probe+0x14/0x24<br /> bus_probe_device+0x94/0x11c<br /> device_add+0x268/0x48c<br /> usb_add_gadget+0x198/0x28c<br /> dwc3_gadget_init+0x700/0x858<br /> __dwc3_set_mode+0x3cc/0x664<br /> process_scheduled_works+0x1d8/0x488<br /> worker_thread+0x244/0x334<br /> kthread+0x114/0x1bc<br /> ret_from_fork+0x10/0x20

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_ecm: Refactor bind path to use __free()<br /> <br /> After an bind/unbind cycle, the ecm-&gt;notify_req is left stale. If a<br /> subsequent bind fails, the unified error label attempts to free this<br /> stale request, leading to a NULL pointer dereference when accessing<br /> ep-&gt;ops-&gt;free_request.<br /> <br /> Refactor the error handling in the bind path to use the __free()<br /> automatic cleanup mechanism.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_acm: Refactor bind path to use __free()<br /> <br /> After an bind/unbind cycle, the acm-&gt;notify_req is left stale. If a<br /> subsequent bind fails, the unified error label attempts to free this<br /> stale request, leading to a NULL pointer dereference when accessing<br /> ep-&gt;ops-&gt;free_request.<br /> <br /> Refactor the error handling in the bind path to use the __free()<br /> automatic cleanup mechanism.<br /> <br /> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020<br /> Call trace:<br /> usb_ep_free_request+0x2c/0xec<br /> gs_free_req+0x30/0x44<br /> acm_bind+0x1b8/0x1f4<br /> usb_add_function+0xcc/0x1f0<br /> configfs_composite_bind+0x468/0x588<br /> gadget_bind_driver+0x104/0x270<br /> really_probe+0x190/0x374<br /> __driver_probe_device+0xa0/0x12c<br /> driver_probe_device+0x3c/0x218<br /> __device_attach_driver+0x14c/0x188<br /> bus_for_each_drv+0x10c/0x168<br /> __device_attach+0xfc/0x198<br /> device_initial_probe+0x14/0x24<br /> bus_probe_device+0x94/0x11c<br /> device_add+0x268/0x48c<br /> usb_add_gadget+0x198/0x28c<br /> dwc3_gadget_init+0x700/0x858<br /> __dwc3_set_mode+0x3cc/0x664<br /> process_scheduled_works+0x1d8/0x488<br /> worker_thread+0x244/0x334<br /> kthread+0x114/0x1bc<br /> ret_from_fork+0x10/0x20

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_rndis: Refactor bind path to use __free()<br /> <br /> After an bind/unbind cycle, the rndis-&gt;notify_req is left stale. If a<br /> subsequent bind fails, the unified error label attempts to free this<br /> stale request, leading to a NULL pointer dereference when accessing<br /> ep-&gt;ops-&gt;free_request.<br /> <br /> Refactor the error handling in the bind path to use the __free()<br /> automatic cleanup mechanism.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix recursive locking in RPC handle list access<br /> <br /> Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list<br /> access"), ksmbd_session_rpc_method() attempts to lock sess-&gt;rpc_lock.<br /> <br /> This causes hung connections / tasks when a client attempts to open<br /> a named pipe. Using Samba&amp;#39;s rpcclient tool:<br /> <br /> $ rpcclient //192.168.1.254 -U user%password<br /> $ rpcclient $&gt; srvinfo<br /> <br /> <br /> Kernel side:<br /> "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.<br /> task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000<br /> Workqueue: ksmbd-io handle_ksmbd_work<br /> Call trace:<br /> __schedule from schedule+0x3c/0x58<br /> schedule from schedule_preempt_disabled+0xc/0x10<br /> schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8<br /> rwsem_down_read_slowpath from down_read+0x28/0x30<br /> down_read from ksmbd_session_rpc_method+0x18/0x3c<br /> ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68<br /> ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228<br /> ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8<br /> create_smb2_pipe from smb2_open+0x10c/0x27ac<br /> smb2_open from handle_ksmbd_work+0x238/0x3dc<br /> handle_ksmbd_work from process_scheduled_works+0x160/0x25c<br /> process_scheduled_works from worker_thread+0x16c/0x1e8<br /> worker_thread from kthread+0xa8/0xb8<br /> kthread from ret_from_fork+0x14/0x38<br /> Exception stack(0x8529ffb0 to 0x8529fff8)<br /> <br /> The task deadlocks because the lock is already held:<br /> ksmbd_session_rpc_open<br /> down_write(&amp;sess-&gt;rpc_lock)<br /> ksmbd_rpc_open<br /> ksmbd_session_rpc_method<br /> down_read(&amp;sess-&gt;rpc_lock)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: Don&amp;#39;t allow evicting of BOs in same VM in array of VM binds<br /> <br /> An array of VM binds can potentially evict other buffer objects (BOs)<br /> within the same VM under certain conditions, which may lead to NULL<br /> pointer dereferences later in the bind pipeline. To prevent this, clear<br /> the allow_res_evict flag in the xe_bo_validate call.<br /> <br /> v2:<br /> - Invert polarity of no_res_evict (Thomas)<br /> - Add comment in code explaining issue (Thomas)<br /> <br /> (cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08)