Vulnerabilities

IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979.

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: elantech - fix stack out of bound access in elantech_change_report_id()<br /> <br /> The array param[] in elantech_change_report_id() must be at least 3<br /> bytes, because elantech_read_reg_params() is calling ps2_command() with<br /> PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but<br /> it&amp;#39;s defined in the stack as an array of 2 bytes, therefore we have a<br /> potential stack out-of-bounds access here, also confirmed by KASAN:<br /> <br /> [ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0<br /> [ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118<br /> <br /> [ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110<br /> [ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020<br /> [ 6.512436] Workqueue: events_long serio_handle_event<br /> [ 6.512453] Call Trace:<br /> [ 6.512462] show_stack+0x52/0x58<br /> [ 6.512474] dump_stack+0xa1/0xd3<br /> [ 6.512487] print_address_description.constprop.0+0x1d/0x140<br /> [ 6.512502] ? __ps2_command+0x372/0x7e0<br /> [ 6.512516] __kasan_report.cold+0x7d/0x112<br /> [ 6.512527] ? _raw_write_lock_irq+0x20/0xd0<br /> [ 6.512539] ? __ps2_command+0x372/0x7e0<br /> [ 6.512552] kasan_report+0x3c/0x50<br /> [ 6.512564] __asan_load1+0x6a/0x70<br /> [ 6.512575] __ps2_command+0x372/0x7e0<br /> [ 6.512589] ? ps2_drain+0x240/0x240<br /> [ 6.512601] ? dev_printk_emit+0xa2/0xd3<br /> [ 6.512612] ? dev_vprintk_emit+0xc5/0xc5<br /> [ 6.512621] ? __kasan_check_write+0x14/0x20<br /> [ 6.512634] ? mutex_lock+0x8f/0xe0<br /> [ 6.512643] ? __mutex_lock_slowpath+0x20/0x20<br /> [ 6.512655] ps2_command+0x52/0x90<br /> [ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse]<br /> [ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse]<br /> [ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse]<br /> [ 6.512863] ? ps2_command+0x7f/0x90<br /> [ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse]<br /> [ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse]<br /> [ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse]<br /> [ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse]<br /> [ 6.513122] ? phys_pmd_init+0x30e/0x521<br /> [ 6.513137] elantech_init+0x8a/0x200 [psmouse]<br /> [ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse]<br /> [ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse]<br /> [ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse]<br /> [ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse]<br /> [ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse]<br /> [ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse]<br /> [ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse]<br /> [ 6.513519] ? mutex_unlock+0x22/0x40<br /> [ 6.513526] ? ps2_command+0x7f/0x90<br /> [ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse]<br /> [ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse]<br /> [ 6.513624] psmouse_connect+0x272/0x530 [psmouse]<br /> [ 6.513669] serio_driver_probe+0x55/0x70<br /> [ 6.513679] really_probe+0x190/0x720<br /> [ 6.513689] driver_probe_device+0x160/0x1f0<br /> [ 6.513697] device_driver_attach+0x119/0x130<br /> [ 6.513705] ? device_driver_attach+0x130/0x130<br /> [ 6.513713] __driver_attach+0xe7/0x1a0<br /> [ 6.513720] ? device_driver_attach+0x130/0x130<br /> [ 6.513728] bus_for_each_dev+0xfb/0x150<br /> [ 6.513738] ? subsys_dev_iter_exit+0x10/0x10<br /> [ 6.513748] ? _raw_write_unlock_bh+0x30/0x30<br /> [ 6.513757] driver_attach+0x2d/0x40<br /> [ 6.513764] serio_handle_event+0x199/0x3d0<br /> [ 6.513775] process_one_work+0x471/0x740<br /> [ 6.513785] worker_thread+0x2d2/0x790<br /> [ 6.513794] ? process_one_work+0x740/0x740<br /> [ 6.513802] kthread+0x1b4/0x1e0<br /> [ 6.513809] ? set_kthread_struct+0x80/0x80<br /> [ 6.513816] ret_from_fork+0x22/0x30<br /> <br /> [ 6.513832] The buggy address belongs to the page:<br /> [ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7<br /> [ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)<br /> [ 6.513860] raw: 0<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations<br /> <br /> Commit b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of<br /> temperature calculations") addressed a number of underflow situations<br /> when writing temperature limits. However, it missed one situation, seen<br /> when an attempt is made to set the hysteresis value to MAX_LONG and the<br /> critical temperature limit is negative.<br /> <br /> Use clamp_val() when setting the hysteresis temperature to ensure that<br /> the provided value can never overflow or underflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> veth: ensure skb entering GRO are not cloned.<br /> <br /> After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"),<br /> if GRO is enabled on a veth device and TSO is disabled on the peer<br /> device, TCP skbs will go through the NAPI callback. If there is no XDP<br /> program attached, the veth code does not perform any share check, and<br /> shared/cloned skbs could enter the GRO engine.<br /> <br /> Ignat reported a BUG triggered later-on due to the above condition:<br /> <br /> [ 53.970529][ C1] kernel BUG at net/core/skbuff.c:3574!<br /> [ 53.981755][ C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI<br /> [ 53.982634][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25<br /> [ 53.982634][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015<br /> [ 53.982634][ C1] RIP: 0010:skb_shift+0x13ef/0x23b0<br /> [ 53.982634][ C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0<br /> 7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f<br /> 85 74 f5 ff ff 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89<br /> f7 4c 89 8c<br /> [ 53.982634][ C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246<br /> [ 53.982634][ C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000<br /> [ 53.982634][ C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2<br /> [ 53.982634][ C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0<br /> [ 53.982634][ C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590<br /> [ 53.982634][ C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0<br /> [ 53.982634][ C1] FS: 0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000<br /> [ 53.982634][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 53.982634][ C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0<br /> [ 53.982634][ C1] Call Trace:<br /> [ 53.982634][ C1] <br /> [ 53.982634][ C1] tcp_sacktag_walk+0xaba/0x18e0<br /> [ 53.982634][ C1] tcp_sacktag_write_queue+0xe7b/0x3460<br /> [ 53.982634][ C1] tcp_ack+0x2666/0x54b0<br /> [ 53.982634][ C1] tcp_rcv_established+0x4d9/0x20f0<br /> [ 53.982634][ C1] tcp_v4_do_rcv+0x551/0x810<br /> [ 53.982634][ C1] tcp_v4_rcv+0x22ed/0x2ed0<br /> [ 53.982634][ C1] ip_protocol_deliver_rcu+0x96/0xaf0<br /> [ 53.982634][ C1] ip_local_deliver_finish+0x1e0/0x2f0<br /> [ 53.982634][ C1] ip_sublist_rcv_finish+0x211/0x440<br /> [ 53.982634][ C1] ip_list_rcv_finish.constprop.0+0x424/0x660<br /> [ 53.982634][ C1] ip_list_rcv+0x2c8/0x410<br /> [ 53.982634][ C1] __netif_receive_skb_list_core+0x65c/0x910<br /> [ 53.982634][ C1] netif_receive_skb_list_internal+0x5f9/0xcb0<br /> [ 53.982634][ C1] napi_complete_done+0x188/0x6e0<br /> [ 53.982634][ C1] gro_cell_poll+0x10c/0x1d0<br /> [ 53.982634][ C1] __napi_poll+0xa1/0x530<br /> [ 53.982634][ C1] net_rx_action+0x567/0x1270<br /> [ 53.982634][ C1] __do_softirq+0x28a/0x9ba<br /> [ 53.982634][ C1] run_ksoftirqd+0x32/0x60<br /> [ 53.982634][ C1] smpboot_thread_fn+0x559/0x8c0<br /> [ 53.982634][ C1] kthread+0x3b9/0x490<br /> [ 53.982634][ C1] ret_from_fork+0x22/0x30<br /> [ 53.982634][ C1] <br /> <br /> Address the issue by skipping the GRO stage for shared or cloned skbs.<br /> To reduce the chance of OoO, try to unclone the skbs before giving up.<br /> <br /> v1 -&gt; v2:<br /> - use avoid skb_copy and fallback to netif_receive_skb - Eric

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module<br /> <br /> Hi,<br /> <br /> When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko,<br /> the system crashed.<br /> <br /> The log as follows:<br /> [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a<br /> [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0<br /> [ 141.087464] Oops: 0010 [#1] SMP NOPTI<br /> [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47<br /> [ 141.088009] Workqueue: events 0xffffffffc09b3a40<br /> [ 141.088009] RIP: 0010:0xffffffffc09b3a5a<br /> [ 141.088009] Code: Bad RIP value.<br /> [ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246<br /> [ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000<br /> [ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246<br /> [ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1<br /> [ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700<br /> [ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8<br /> [ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000<br /> [ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0<br /> [ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> [ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> [ 141.088009] PKRU: 55555554<br /> [ 141.088009] Call Trace:<br /> [ 141.088009] ? process_one_work+0x195/0x390<br /> [ 141.088009] ? worker_thread+0x30/0x390<br /> [ 141.088009] ? process_one_work+0x390/0x390<br /> [ 141.088009] ? kthread+0x10d/0x130<br /> [ 141.088009] ? kthread_flush_work_fn+0x10/0x10<br /> [ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a<br /> [ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0<br /> [ 200.223464] Oops: 0010 [#1] SMP NOPTI<br /> [ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46<br /> [ 200.224008] Workqueue: events 0xffffffffc0b28a40<br /> [ 200.224008] RIP: 0010:0xffffffffc0b28a5a<br /> [ 200.224008] Code: Bad RIP value.<br /> [ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246<br /> [ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000<br /> [ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246<br /> [ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5<br /> [ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700<br /> [ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8<br /> [ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000<br /> [ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0<br /> [ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> [ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> [ 200.224008] PKRU: 55555554<br /> [ 200.224008] Call Trace:<br /> [ 200.224008] ? process_one_work+0x195/0x390<br /> [ 200.224008] ? worker_thread+0x30/0x390<br /> [ 200.224008] ? process_one_work+0x390/0x390<br /> [ 200.224008] ? kthread+0x10d/0x130<br /> [ 200.224008] ? kthread_flush_work_fn+0x10/0x10<br /> [ 200.224008] ? ret_from_fork+0x35/0x40<br /> [ 200.224008] kernel fault(0x1) notification starting on CPU 63<br /> [ 200.224008] kernel fault(0x1) notification finished on CPU 63<br /> [ 200.224008] CR2: ffffffffc0b28a5a<br /> [ 200.224008] ---[ end trace c82a412d93f57412 ]---<br /> <br /> The reason is as follows:<br /> T1: rmmod ipmi_si.<br /> -&gt;ipmi_unregister_smi()<br /> -&gt; ipmi_bmc_unregister()<br /> -&gt; __ipmi_bmc_unregister()<br /> -&gt; kref_put(&amp;bmc-&gt;usecount, cleanup_bmc_device);<br /> -&gt; schedule_work(&amp;bmc-&gt;remove_work);<br /> <br /> T2: rmmod ipmi_msghandl<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> asix: fix uninit-value in asix_mdio_read()<br /> <br /> asix_read_cmd() may read less than sizeof(smsr) bytes and in this case<br /> smsr will be uninitialized.<br /> <br /> Fail log:<br /> BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]<br /> BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497<br /> BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497<br /> asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]<br /> asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497<br /> asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: marvell: prestera: fix incorrect structure access<br /> <br /> In line:<br /> upper = info-&gt;upper_dev;<br /> We access upper_dev field, which is related only for particular events<br /> (e.g. event == NETDEV_CHANGEUPPER). So, this line cause invalid memory<br /> access for another events,<br /> when ptr is not netdev_notifier_changeupper_info.<br /> <br /> The KASAN logs are as follows:<br /> <br /> [ 30.123165] BUG: KASAN: stack-out-of-bounds in prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera]<br /> [ 30.133336] Read of size 8 at addr ffff80000cf772b0 by task udevd/778<br /> [ 30.139866]<br /> [ 30.141398] CPU: 0 PID: 778 Comm: udevd Not tainted 5.16.0-rc3 #6<br /> [ 30.147588] Hardware name: DNI AmazonGo1 A7040 board (DT)<br /> [ 30.153056] Call trace:<br /> [ 30.155547] dump_backtrace+0x0/0x2c0<br /> [ 30.159320] show_stack+0x18/0x30<br /> [ 30.162729] dump_stack_lvl+0x68/0x84<br /> [ 30.166491] print_address_description.constprop.0+0x74/0x2b8<br /> [ 30.172346] kasan_report+0x1e8/0x250<br /> [ 30.176102] __asan_load8+0x98/0xe0<br /> [ 30.179682] prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera]<br /> [ 30.186847] prestera_netdev_event_handler+0x1b4/0x1c0 [prestera]<br /> [ 30.193313] raw_notifier_call_chain+0x74/0xa0<br /> [ 30.197860] call_netdevice_notifiers_info+0x68/0xc0<br /> [ 30.202924] register_netdevice+0x3cc/0x760<br /> [ 30.207190] register_netdev+0x24/0x50<br /> [ 30.211015] prestera_device_register+0x8a0/0xba0 [prestera]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> inet: fully convert sk-&gt;sk_rx_dst to RCU rules<br /> <br /> syzbot reported various issues around early demux,<br /> one being included in this changelog [1]<br /> <br /> sk-&gt;sk_rx_dst is using RCU protection without clearly<br /> documenting it.<br /> <br /> And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv()<br /> are not following standard RCU rules.<br /> <br /> [a] dst_release(dst);<br /> [b] sk-&gt;sk_rx_dst = NULL;<br /> <br /> They look wrong because a delete operation of RCU protected<br /> pointer is supposed to clear the pointer before<br /> the call_rcu()/synchronize_rcu() guarding actual memory freeing.<br /> <br /> In some cases indeed, dst could be freed before [b] is done.<br /> <br /> We could cheat by clearing sk_rx_dst before calling<br /> dst_release(), but this seems the right time to stick<br /> to standard RCU annotations and debugging facilities.<br /> <br /> [1]<br /> BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline]<br /> BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792<br /> Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204<br /> <br /> CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106<br /> print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247<br /> __kasan_report mm/kasan/report.c:433 [inline]<br /> kasan_report.cold+0x83/0xdf mm/kasan/report.c:450<br /> dst_check include/net/dst.h:470 [inline]<br /> tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792<br /> ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340<br /> ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583<br /> ip_sublist_rcv net/ipv4/ip_input.c:609 [inline]<br /> ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644<br /> __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline]<br /> __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556<br /> __netif_receive_skb_list net/core/dev.c:5608 [inline]<br /> netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699<br /> gro_normal_list net/core/dev.c:5853 [inline]<br /> gro_normal_list net/core/dev.c:5849 [inline]<br /> napi_complete_done+0x1f1/0x880 net/core/dev.c:6590<br /> virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]<br /> virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557<br /> __napi_poll+0xaf/0x440 net/core/dev.c:7023<br /> napi_poll net/core/dev.c:7090 [inline]<br /> net_rx_action+0x801/0xb40 net/core/dev.c:7177<br /> __do_softirq+0x29b/0x9c2 kernel/softirq.c:558<br /> invoke_softirq kernel/softirq.c:432 [inline]<br /> __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637<br /> irq_exit_rcu+0x5/0x20 kernel/softirq.c:649<br /> common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240<br /> asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629<br /> RIP: 0033:0x7f5e972bfd57<br /> Code: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73<br /> RSP: 002b:00007fff8a413210 EFLAGS: 00000283<br /> RAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45<br /> RDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45<br /> RBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9<br /> R10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0<br /> R13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019<br /> <br /> <br /> Allocated by task 13:<br /> kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38<br /> kasan_set_track mm/kasan/common.c:46 [inline]<br /> set_alloc_info mm/kasan/common.c:434 [inline]<br /> __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467<br /> kasan_slab_alloc include/linux/kasan.h:259 [inline]<br /> slab_post_alloc_hook mm/slab.h:519 [inline]<br /> slab_alloc_node mm/slub.c:3234 [inline]<br /> slab_alloc mm/slub.c:3242 [inline]<br /> kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247<br /> dst_alloc+0x146/0x1f0 net/core/dst.c:92<br /> rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613<br /> ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:234<br /> ---truncated---

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tun: avoid double free in tun_free_netdev<br /> <br /> Avoid double free in tun_free_netdev() by moving the<br /> dev-&gt;tstats and tun-&gt;security allocs to a new ndo_init routine<br /> (tun_net_init()) that will be called by register_netdevice().<br /> ndo_init is paired with the desctructor (tun_free_netdev()),<br /> so if there&amp;#39;s an error in register_netdevice() the destructor<br /> will handle the frees.<br /> <br /> BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605<br /> <br /> CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1<br /> Hardware name: Red Hat KVM, BIOS<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106<br /> print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247<br /> kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372<br /> ____kasan_slab_free mm/kasan/common.c:346 [inline]<br /> __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374<br /> kasan_slab_free include/linux/kasan.h:235 [inline]<br /> slab_free_hook mm/slub.c:1723 [inline]<br /> slab_free_freelist_hook mm/slub.c:1749 [inline]<br /> slab_free mm/slub.c:3513 [inline]<br /> kfree+0xac/0x2d0 mm/slub.c:4561<br /> selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605<br /> security_tun_dev_free_security+0x4f/0x90 security/security.c:2342<br /> tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215<br /> netdev_run_todo+0x4df/0x840 net/core/dev.c:10627<br /> rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112<br /> __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302<br /> tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311<br /> vfs_ioctl fs/ioctl.c:51 [inline]<br /> __do_sys_ioctl fs/ioctl.c:874 [inline]<br /> __se_sys_ioctl fs/ioctl.c:860 [inline]<br /> __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860<br /> do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae