Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm: /proc/pid/smaps_rollup: fix no vma&amp;#39;s null-deref<br /> <br /> Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value<br /> seq_file") introduced a null-deref if there are no vma&amp;#39;s in the task in<br /> show_smaps_rollup.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md: fix a crash in mempool_free<br /> <br /> There&amp;#39;s a crash in mempool_free when running the lvm test<br /> shell/lvchange-rebuild-raid.sh.<br /> <br /> The reason for the crash is this:<br /> * super_written calls atomic_dec_and_test(&amp;mddev-&gt;pending_writes) and<br /> wake_up(&amp;mddev-&gt;sb_wait). Then it calls rdev_dec_pending(rdev, mddev)<br /> and bio_put(bio).<br /> * so, the process that waited on sb_wait and that is woken up is racing<br /> with bio_put(bio).<br /> * if the process wins the race, it calls bioset_exit before bio_put(bio)<br /> is executed.<br /> * bio_put(bio) attempts to free a bio into a destroyed bio set - causing<br /> a crash in mempool_free.<br /> <br /> We fix this bug by moving bio_put before atomic_dec_and_test.<br /> <br /> We also move rdev_dec_pending before atomic_dec_and_test as suggested by<br /> Neil Brown.<br /> <br /> The function md_end_flush has a similar bug - we must call bio_put before<br /> we decrement the number of in-progress bios.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> #PF: supervisor write access in kernel mode<br /> #PF: error_code(0x0002) - not-present page<br /> PGD 11557f0067 P4D 11557f0067 PUD 0<br /> Oops: 0002 [#1] PREEMPT SMP<br /> CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014<br /> Workqueue: kdelayd flush_expired_bios [dm_delay]<br /> RIP: 0010:mempool_free+0x47/0x80<br /> Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00<br /> RSP: 0018:ffff88910036bda8 EFLAGS: 00010093<br /> RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001<br /> RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8<br /> RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900<br /> R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000<br /> R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05<br /> FS: 0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0<br /> Call Trace:<br /> <br /> clone_endio+0xf4/0x1c0 [dm_mod]<br /> clone_endio+0xf4/0x1c0 [dm_mod]<br /> __submit_bio+0x76/0x120<br /> submit_bio_noacct_nocheck+0xb6/0x2a0<br /> flush_expired_bios+0x28/0x2f [dm_delay]<br /> process_one_work+0x1b4/0x300<br /> worker_thread+0x45/0x3e0<br /> ? rescuer_thread+0x380/0x380<br /> kthread+0xc2/0x100<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork+0x1f/0x30<br /> <br /> Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd]<br /> CR2: 0000000000000000<br /> ---[ end trace 0000000000000000 ]---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> padata: Always leave BHs disabled when running -&gt;parallel()<br /> <br /> A deadlock can happen when an overloaded system runs -&gt;parallel() in the<br /> context of the current task:<br /> <br /> padata_do_parallel<br /> -&gt;parallel()<br /> pcrypt_aead_enc/dec<br /> padata_do_serial<br /> spin_lock(&amp;reorder-&gt;lock) // BHs still enabled<br /> <br /> ...<br /> __do_softirq<br /> ...<br /> padata_do_serial<br /> spin_lock(&amp;reorder-&gt;lock)<br /> <br /> It&amp;#39;s a bug for BHs to be on in _do_serial as Steffen points out, so<br /> ensure they&amp;#39;re off in the "current task" case like they are in<br /> padata_parallel_worker to avoid this situation.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()<br /> <br /> When insert and remove the orangefs module, there are memory leaked<br /> as below:<br /> <br /> unreferenced object 0xffff88816b0cc000 (size 2048):<br /> comm "insmod", pid 783, jiffies 4294813439 (age 65.512s)<br /> hex dump (first 32 bytes):<br /> 6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00 none............<br /> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................<br /> backtrace:<br /> [] kmalloc_trace+0x27/0xa0<br /> [] orangefs_debugfs_init.cold+0xaf/0x17f<br /> [] 0xffffffffa02780f9<br /> [] do_one_initcall+0x87/0x2a0<br /> [] do_init_module+0xdf/0x320<br /> [] load_module+0x2f98/0x3330<br /> [] __do_sys_finit_module+0x113/0x1b0<br /> [] do_syscall_64+0x35/0x80<br /> [] entry_SYSCALL_64_after_hwframe+0x46/0xb0<br /> <br /> Use the golbal variable as the buffer rather than dynamic allocate to<br /> slove the problem.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/meson: reorder driver deinit sequence to fix use-after-free bug<br /> <br /> Unloading the driver triggers the following KASAN warning:<br /> <br /> [ +0.006275] =============================================================<br /> [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0<br /> [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695<br /> <br /> [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1<br /> [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT)<br /> [ +0.000008] Call trace:<br /> [ +0.000007] dump_backtrace+0x1ec/0x280<br /> [ +0.000013] show_stack+0x24/0x80<br /> [ +0.000008] dump_stack_lvl+0x98/0xd4<br /> [ +0.000011] print_address_description.constprop.0+0x80/0x520<br /> [ +0.000011] print_report+0x128/0x260<br /> [ +0.000007] kasan_report+0xb8/0xfc<br /> [ +0.000008] __asan_report_load8_noabort+0x3c/0x50<br /> [ +0.000010] __list_del_entry_valid+0xe0/0x1a0<br /> [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm]<br /> [ +0.000172] drm_bridge_detach+0x94/0x260 [drm]<br /> [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm]<br /> [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm]<br /> [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm]<br /> [ +0.000144] drm_managed_release+0x170/0x414 [drm]<br /> [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm]<br /> [ +0.000143] drm_dev_put+0x20/0x30 [drm]<br /> [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm]<br /> [ +0.000028] take_down_aggregate_device+0xb0/0x160<br /> [ +0.000016] component_del+0x18c/0x360<br /> [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]<br /> [ +0.000015] platform_remove+0x64/0xb0<br /> [ +0.000009] device_remove+0xb8/0x154<br /> [ +0.000009] device_release_driver_internal+0x398/0x5b0<br /> [ +0.000009] driver_detach+0xac/0x1b0<br /> [ +0.000009] bus_remove_driver+0x158/0x29c<br /> [ +0.000009] driver_unregister+0x70/0xb0<br /> [ +0.000008] platform_driver_unregister+0x20/0x2c<br /> [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]<br /> [ +0.000012] __do_sys_delete_module+0x288/0x400<br /> [ +0.000011] __arm64_sys_delete_module+0x5c/0x80<br /> [ +0.000009] invoke_syscall+0x74/0x260<br /> [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260<br /> [ +0.000009] do_el0_svc+0x50/0x70<br /> [ +0.000007] el0_svc+0x68/0x1a0<br /> [ +0.000012] el0t_64_sync_handler+0x11c/0x150<br /> [ +0.000008] el0t_64_sync+0x18c/0x190<br /> <br /> [ +0.000018] Allocated by task 0:<br /> [ +0.000007] (stack is not available)<br /> <br /> [ +0.000011] Freed by task 2695:<br /> [ +0.000008] kasan_save_stack+0x2c/0x5c<br /> [ +0.000011] kasan_set_track+0x2c/0x40<br /> [ +0.000008] kasan_set_free_info+0x28/0x50<br /> [ +0.000009] ____kasan_slab_free+0x128/0x1d4<br /> [ +0.000008] __kasan_slab_free+0x18/0x24<br /> [ +0.000007] slab_free_freelist_hook+0x108/0x230<br /> [ +0.000011] kfree+0x110/0x35c<br /> [ +0.000008] release_nodes+0xf0/0x16c<br /> [ +0.000009] devres_release_group+0x180/0x270<br /> [ +0.000008] component_unbind+0x128/0x1e0<br /> [ +0.000010] component_unbind_all+0x1b8/0x264<br /> [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm]<br /> [ +0.000025] take_down_aggregate_device+0xb0/0x160<br /> [ +0.000009] component_del+0x18c/0x360<br /> [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]<br /> [ +0.000012] platform_remove+0x64/0xb0<br /> [ +0.000008] device_remove+0xb8/0x154<br /> [ +0.000009] device_release_driver_internal+0x398/0x5b0<br /> [ +0.000009] driver_detach+0xac/0x1b0<br /> [ +0.000009] bus_remove_driver+0x158/0x29c<br /> [ +0.000008] driver_unregister+0x70/0xb0<br /> [ +0.000008] platform_driver_unregister+0x20/0x2c<br /> [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]<br /> [ +0.000011] __do_sys_delete_module+0x288/0x400<br /> [ +0.000010] __arm64_sys_delete_module+0x5c/0x80<br /> [ +0.000008] invoke_syscall+0x74/0x260<br /> [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260<br /> [ +0.000008] do_el0_svc+0x50/0x70<br /> [ +0.000007] el0_svc+0x68/0x1a0<br /> [ +0.000009] el0t_64_sync_handler+0x11c/0x150<br /> [ +0.000009] el0t_64_sync+0x18c/0x190<br /> <br /> [ +0.000014] The buggy address belongs to the object at ffff000020c39000<br /> ---truncated---

A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_msg.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Profilers/PProfile/COUNT3s3.php. The manipulation of the argument csem leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.

Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation.<br /> <br /> <br /> <br /> <br /> This issue affects FLXEON: through 9.3.5.