Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: bridge: xmit: make sure we have at least eth header len bytes<br /> <br /> syzbot triggered an uninit value[1] error in bridge device&amp;#39;s xmit path<br /> by sending a short (less than ETH_HLEN bytes) skb. To fix it check if<br /> we can actually pull that amount instead of assuming.<br /> <br /> Tested with dropwatch:<br /> drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)<br /> origin: software<br /> timestamp: Mon May 13 11:31:53 2024 778214037 nsec<br /> protocol: 0x88a8<br /> length: 2<br /> original length: 2<br /> drop reason: PKT_TOO_SMALL<br /> <br /> [1]<br /> BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65<br /> br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65<br /> __netdev_start_xmit include/linux/netdevice.h:4903 [inline]<br /> netdev_start_xmit include/linux/netdevice.h:4917 [inline]<br /> xmit_one net/core/dev.c:3531 [inline]<br /> dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547<br /> __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341<br /> dev_queue_xmit include/linux/netdevice.h:3091 [inline]<br /> __bpf_tx_skb net/core/filter.c:2136 [inline]<br /> __bpf_redirect_common net/core/filter.c:2180 [inline]<br /> __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187<br /> ____bpf_clone_redirect net/core/filter.c:2460 [inline]<br /> bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432<br /> ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997<br /> __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238<br /> bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]<br /> __bpf_prog_run include/linux/filter.h:657 [inline]<br /> bpf_prog_run include/linux/filter.h:664 [inline]<br /> bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425<br /> bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058<br /> bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269<br /> __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678<br /> __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]<br /> __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]<br /> __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765<br /> x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322<br /> do_syscall_x64 arch/x86/entry/common.c:52 [inline]<br /> do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt<br /> <br /> In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the<br /> resp_pkts queue and then a decision is made whether to run the completer<br /> task inline or schedule it. Finally the skb is dereferenced to bump a &amp;#39;hw&amp;#39;<br /> performance counter. This is wrong because if the completer task is<br /> already running in a separate thread it may have already processed the skb<br /> and freed it which can cause a seg fault. This has been observed<br /> infrequently in testing at high scale.<br /> <br /> This patch fixes this by changing the order of enqueuing the packet until<br /> after the counter is accessed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> of: module: add buffer overflow check in of_modalias()<br /> <br /> In of_modalias(), if the buffer happens to be too small even for the 1st<br /> snprintf() call, the len parameter will become negative and str parameter<br /> (if not NULL initially) will point beyond the buffer&amp;#39;s end. Add the buffer<br /> overflow check after the 1st snprintf() call and fix such check after the<br /> strlen() call (accounting for the terminating NUL char).

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq<br /> <br /> Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called<br /> with hwq_attr-&gt;aux_depth != 0 and hwq_attr-&gt;aux_stride == 0.<br /> In that case, "roundup_pow_of_two(hwq_attr-&gt;aux_stride)" gets called.<br /> roundup_pow_of_two is documented as undefined for 0.<br /> <br /> Fix it in the one caller that had this combination.<br /> <br /> The undefined behavior was detected by UBSAN:<br /> UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13<br /> shift exponent 64 is too large for 64-bit type &amp;#39;long unsigned int&amp;#39;<br /> CPU: 24 PID: 1075 Comm: (udev-worker) Not tainted 6.9.0-rc6+ #4<br /> Hardware name: Abacus electric, s.r.o. - servis@abacus.cz Super Server/H12SSW-iN, BIOS 2.7 10/25/2023<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x5d/0x80<br /> ubsan_epilogue+0x5/0x30<br /> __ubsan_handle_shift_out_of_bounds.cold+0x61/0xec<br /> __roundup_pow_of_two+0x25/0x35 [bnxt_re]<br /> bnxt_qplib_alloc_init_hwq+0xa1/0x470 [bnxt_re]<br /> bnxt_qplib_create_qp+0x19e/0x840 [bnxt_re]<br /> bnxt_re_create_qp+0x9b1/0xcd0 [bnxt_re]<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? __kmalloc+0x1b6/0x4f0<br /> ? create_qp.part.0+0x128/0x1c0 [ib_core]<br /> ? __pfx_bnxt_re_create_qp+0x10/0x10 [bnxt_re]<br /> create_qp.part.0+0x128/0x1c0 [ib_core]<br /> ib_create_qp_kernel+0x50/0xd0 [ib_core]<br /> create_mad_qp+0x8e/0xe0 [ib_core]<br /> ? __pfx_qp_event_handler+0x10/0x10 [ib_core]<br /> ib_mad_init_device+0x2be/0x680 [ib_core]<br /> add_client_context+0x10d/0x1a0 [ib_core]<br /> enable_device_and_get+0xe0/0x1d0 [ib_core]<br /> ib_register_device+0x53c/0x630 [ib_core]<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> bnxt_re_probe+0xbd8/0xe50 [bnxt_re]<br /> ? __pfx_bnxt_re_probe+0x10/0x10 [bnxt_re]<br /> auxiliary_bus_probe+0x49/0x80<br /> ? driver_sysfs_add+0x57/0xc0<br /> really_probe+0xde/0x340<br /> ? pm_runtime_barrier+0x54/0x90<br /> ? __pfx___driver_attach+0x10/0x10<br /> __driver_probe_device+0x78/0x110<br /> driver_probe_device+0x1f/0xa0<br /> __driver_attach+0xba/0x1c0<br /> bus_for_each_dev+0x8f/0xe0<br /> bus_add_driver+0x146/0x220<br /> driver_register+0x72/0xd0<br /> __auxiliary_driver_register+0x6e/0xd0<br /> ? __pfx_bnxt_re_mod_init+0x10/0x10 [bnxt_re]<br /> bnxt_re_mod_init+0x3e/0xff0 [bnxt_re]<br /> ? __pfx_bnxt_re_mod_init+0x10/0x10 [bnxt_re]<br /> do_one_initcall+0x5b/0x310<br /> do_init_module+0x90/0x250<br /> init_module_from_file+0x86/0xc0<br /> idempotent_init_module+0x121/0x2b0<br /> __x64_sys_finit_module+0x5e/0xb0<br /> do_syscall_64+0x82/0x160<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? syscall_exit_to_user_mode_prepare+0x149/0x170<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? syscall_exit_to_user_mode+0x75/0x230<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? do_syscall_64+0x8e/0x160<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? __count_memcg_events+0x69/0x100<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? count_memcg_events.constprop.0+0x1a/0x30<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? handle_mm_fault+0x1f0/0x300<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? do_user_addr_fault+0x34e/0x640<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> ? srso_alias_return_thunk+0x5/0xfbef5<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7f4e5132821d<br /> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 db 0c 00 f7 d8 64 89 01 48<br /> RSP: 002b:00007ffca9c906a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139<br /> RAX: ffffffffffffffda RBX: 0000563ec8a8f130 RCX: 00007f4e5132821d<br /> RDX: 0000000000000000 RSI: 00007f4e518fa07d RDI: 000000000000003b<br /> RBP: 00007ffca9c90760 R08: 00007f4e513f6b20 R09: 00007ffca9c906f0<br /> R10: 0000563ec8a8faa0 R11: 0000000000000246 R12: 00007f4e518fa07d<br /> R13: 0000000000020000 R14: 0000563ec8409e90 R15: 0000563ec8a8fa60<br /> <br /> ---[ end trace ]---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/hns: Fix UAF for cq async event<br /> <br /> The refcount of CQ is not protected by locks. When CQ asynchronous<br /> events and CQ destruction are concurrent, CQ may have been released,<br /> which will cause UAF.<br /> <br /> Use the xa_lock() to protect the CQ refcount.

Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: bridge: mst: fix vlan use-after-free<br /> <br /> syzbot reported a suspicious rcu usage[1] in bridge&amp;#39;s mst code. While<br /> fixing it I noticed that nothing prevents a vlan to be freed while<br /> walking the list from the same path (br forward delay timer). Fix the rcu<br /> usage and also make sure we are not accessing freed memory by making<br /> br_mst_vlan_set_state use rcu read lock.<br /> <br /> [1]<br /> WARNING: suspicious RCU usage<br /> 6.9.0-rc6-syzkaller #0 Not tainted<br /> -----------------------------<br /> net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!<br /> ...<br /> stack backtrace:<br /> CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114<br /> lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712<br /> nbp_vlan_group net/bridge/br_private.h:1599 [inline]<br /> br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105<br /> br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47<br /> br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88<br /> call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793<br /> expire_timers kernel/time/timer.c:1844 [inline]<br /> __run_timers kernel/time/timer.c:2418 [inline]<br /> __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429<br /> run_timer_base kernel/time/timer.c:2438 [inline]<br /> run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448<br /> __do_softirq+0x2c6/0x980 kernel/softirq.c:554<br /> invoke_softirq kernel/softirq.c:428 [inline]<br /> __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633<br /> irq_exit_rcu+0x9/0x30 kernel/softirq.c:645<br /> instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]<br /> sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043<br /> <br /> <br /> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702<br /> RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758<br /> Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25<br /> RSP: 0018:ffffc90013657100 EFLAGS: 00000206<br /> RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001<br /> RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60<br /> RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0<br /> R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28<br /> R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994.

Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8.

Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.

Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.