Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> leds: led-core: Fix refcount leak in of_led_get()<br /> <br /> class_find_device_by_of_node() calls class_find_device(), it will take<br /> the reference, use the put_device() to drop the reference when not need<br /> anymore.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix to check readonly condition correctly<br /> <br /> With below case, it can mount multi-device image w/ rw option, however<br /> one of secondary device is set as ro, later update will cause panic, so<br /> let&amp;#39;s introduce f2fs_dev_is_readonly(), and check multi-devices rw status<br /> in f2fs_remount() w/ it in order to avoid such inconsistent mount status.<br /> <br /> mkfs.f2fs -c /dev/zram1 /dev/zram0 -f<br /> blockdev --setro /dev/zram1<br /> mount -t f2fs dev/zram0 /mnt/f2fs<br /> mount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.<br /> mount -t f2fs -o remount,rw mnt/f2fs<br /> dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=8192<br /> <br /> kernel BUG at fs/f2fs/inline.c:258!<br /> RIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]<br /> Call Trace:<br /> f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]<br /> f2fs_write_cache_pages+0x389/0xa60 [f2fs]<br /> __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]<br /> f2fs_write_data_pages+0x2e/0x40 [f2fs]<br /> do_writepages+0xd3/0x1b0<br /> __writeback_single_inode+0x5b/0x420<br /> writeback_sb_inodes+0x236/0x5a0<br /> __writeback_inodes_wb+0x56/0xf0<br /> wb_writeback+0x2a3/0x490<br /> wb_do_writeback+0x2b2/0x330<br /> wb_workfn+0x6a/0x260<br /> process_one_work+0x270/0x5e0<br /> worker_thread+0x52/0x3e0<br /> kthread+0xf4/0x120<br /> ret_from_fork+0x29/0x50

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: target: iscsit: Free cmds before session free<br /> <br /> Commands from recovery entries are freed after session has been closed.<br /> That leads to use-after-free at command free or NPE with such call trace:<br /> <br /> Time2Retain timer expired for SID: 1, cleaning up iSCSI session.<br /> BUG: kernel NULL pointer dereference, address: 0000000000000140<br /> RIP: 0010:sbitmap_queue_clear+0x3a/0xa0<br /> Call Trace:<br /> target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]<br /> transport_generic_free_cmd+0xd1/0x180 [target_core_mod]<br /> iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]<br /> iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]<br /> iscsit_close_session+0x13a/0x140 [iscsi_target_mod]<br /> iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]<br /> call_timer_fn+0x24/0x140<br /> <br /> Move cleanup of recovery enrties to before session freeing.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: altmodes/displayport: fix pin_assignment_show<br /> <br /> This patch fixes negative indexing of buf array in pin_assignment_show<br /> when get_current_pin_assignments returns 0 i.e. no compatible pin<br /> assignments are found.<br /> <br /> BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c<br /> ...<br /> Call trace:<br /> dump_backtrace+0x110/0x204<br /> dump_stack_lvl+0x84/0xbc<br /> print_report+0x358/0x974<br /> kasan_report+0x9c/0xfc<br /> __do_kernel_fault+0xd4/0x2d4<br /> do_bad_area+0x48/0x168<br /> do_tag_check_fault+0x24/0x38<br /> do_mem_abort+0x6c/0x14c<br /> el1_abort+0x44/0x68<br /> el1h_64_sync_handler+0x64/0xa4<br /> el1h_64_sync+0x78/0x7c<br /> pin_assignment_show+0x26c/0x33c<br /> dev_attr_show+0x50/0xc0

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix potential corruption when moving a directory<br /> <br /> F2FS has the same issue in ext4_rename causing crash revealed by<br /> xfstests/generic/707.<br /> <br /> See also commit 0813299c586b ("ext4: Fix possible corruption when moving a directory")

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction<br /> <br /> On hardware that supports Indirect Branch Tracking (IBT), Hyper-V VMs<br /> with ConfigVersion 9.3 or later support IBT in the guest. However,<br /> current versions of Hyper-V have a bug in that there&amp;#39;s not an ENDBR64<br /> instruction at the beginning of the hypercall page. Since hypercalls are<br /> made with an indirect call to the hypercall page, all hypercall attempts<br /> fail with an exception and Linux panics.<br /> <br /> A Hyper-V fix is in progress to add ENDBR64. But guard against the Linux<br /> panic by clearing X86_FEATURE_IBT if the hypercall page doesn&amp;#39;t start<br /> with ENDBR. The VM will boot and run without IBT.<br /> <br /> If future Linux 32-bit kernels were to support IBT, additional hypercall<br /> page hackery would be needed to make IBT work for such kernels in a<br /> Hyper-V VM.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio: Fix NULL pointer dereference caused by uninitialized group-&gt;iommufd<br /> <br /> group-&gt;iommufd is not initialized for the iommufd_ctx_put()<br /> <br /> [20018.331541] BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> [20018.377508] RIP: 0010:iommufd_ctx_put+0x5/0x10 [iommufd]<br /> ...<br /> [20018.476483] Call Trace:<br /> [20018.479214] <br /> [20018.481555] vfio_group_fops_unl_ioctl+0x506/0x690 [vfio]<br /> [20018.487586] __x64_sys_ioctl+0x6a/0xb0<br /> [20018.491773] ? trace_hardirqs_on+0xc5/0xe0<br /> [20018.496347] do_syscall_64+0x67/0x90<br /> [20018.500340] entry_SYSCALL_64_after_hwframe+0x4b/0xb5

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path<br /> <br /> The xiic_xfer() function gets a runtime PM reference when the function is<br /> entered. This reference is released when the function is exited. There is<br /> currently one error path where the function exits directly, which leads to<br /> a leak of the runtime PM reference.<br /> <br /> Make sure that this error path also releases the runtime PM reference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: stricter state check in mptcp_worker<br /> <br /> As reported by Christoph, the mptcp protocol can run the<br /> worker when the relevant msk socket is in an unexpected state:<br /> <br /> connect()<br /> // incoming reset + fastclose<br /> // the mptcp worker is scheduled<br /> mptcp_disconnect()<br /> // msk is now CLOSED<br /> listen()<br /> mptcp_worker()<br /> <br /> Leading to the following splat:<br /> <br /> divide error: 0000 [#1] PREEMPT SMP<br /> CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014<br /> Workqueue: events mptcp_worker<br /> RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018<br /> RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293<br /> RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004<br /> RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000<br /> R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7<br /> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000<br /> FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> Call Trace:<br /> <br /> tcp_select_window net/ipv4/tcp_output.c:262 [inline]<br /> __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345<br /> tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline]<br /> tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459<br /> mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline]<br /> mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705<br /> process_one_work+0x3bd/0x950 kernel/workqueue.c:2390<br /> worker_thread+0x5b/0x610 kernel/workqueue.c:2537<br /> kthread+0x138/0x170 kernel/kthread.c:376<br /> ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308<br /> <br /> <br /> This change addresses the issue explicitly checking for bad states<br /> before running the mptcp worker.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> quota: fix warning in dqgrab()<br /> <br /> There&amp;#39;s issue as follows when do fault injection:<br /> WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0<br /> Modules linked in:<br /> CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541<br /> RIP: 0010:dquot_disable+0x13b7/0x18c0<br /> RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246<br /> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980<br /> RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002<br /> RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000<br /> R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130<br /> R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118<br /> FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> Call Trace:<br /> <br /> dquot_load_quota_sb+0xd53/0x1060<br /> dquot_resume+0x172/0x230<br /> ext4_reconfigure+0x1dc6/0x27b0<br /> reconfigure_super+0x515/0xa90<br /> __x64_sys_fsconfig+0xb19/0xd20<br /> do_syscall_64+0x39/0xb0<br /> entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Above issue may happens as follows:<br /> ProcessA ProcessB ProcessC<br /> sys_fsconfig<br /> vfs_fsconfig_locked<br /> reconfigure_super<br /> ext4_remount<br /> dquot_suspend -&gt; suspend all type quota<br /> <br /> sys_fsconfig<br /> vfs_fsconfig_locked<br /> reconfigure_super<br /> ext4_remount<br /> dquot_resume<br /> ret = dquot_load_quota_sb<br /> add_dquot_ref<br /> do_open -&gt; open file O_RDWR<br /> vfs_open<br /> do_dentry_open<br /> get_write_access<br /> atomic_inc_unless_negative(&amp;inode-&gt;i_writecount)<br /> ext4_file_open<br /> dquot_file_open<br /> dquot_initialize<br /> __dquot_initialize<br /> dqget<br /> atomic_inc(&amp;dquot-&gt;dq_count);<br /> <br /> __dquot_initialize<br /> __dquot_initialize<br /> dqget<br /> if (!test_bit(DQ_ACTIVE_B, &amp;dquot-&gt;dq_flags))<br /> ext4_acquire_dquot<br /> -&gt; Return error DQ_ACTIVE_B flag isn&amp;#39;t set<br /> dquot_disable<br /> invalidate_dquots<br /> if (atomic_read(&amp;dquot-&gt;dq_count))<br /> dqgrab<br /> WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &amp;dquot-&gt;dq_flags))<br /> -&gt; Trigger warning<br /> <br /> In the above scenario, &amp;#39;dquot-&gt;dq_flags&amp;#39; has no DQ_ACTIVE_B is normal when<br /> dqgrab().<br /> To solve above issue just replace the dqgrab() use in invalidate_dquots() with<br /> atomic_inc(&amp;dquot-&gt;dq_count).

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()<br /> <br /> when kmalloc() fail to allocate memory in kasprintf(), name<br /> or full_name will be NULL, strcmp() will cause<br /> null pointer dereference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: qla2xxx: Array index may go out of bound<br /> <br /> Klocwork reports array &amp;#39;vha-&gt;host_str&amp;#39; of size 16 may use index value(s)<br /> 16..19. Use snprintf() instead of sprintf().