Vulnerabilidades

*** Pendiente de traducción *** The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

*** Pendiente de traducción *** A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.

*** Pendiente de traducción *** docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

*** Pendiente de traducción *** In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

*** Pendiente de traducción *** The Infineon Airoc Wi-Fi driver&amp;#39;s transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbound packet. When whd_network_send_ethernet_data() returns a synchronous failure, the underlying WHD library does not take ownership of the buffer, but the pre-fix driver returned -EIO without releasing it. Each failed transmit therefore permanently leaks one buffer from the pool.<br /> <br /> airoc_pool is small and fixed (AIROC_WIFI_TX_PACKET_POOL_COUNT + AIROC_WIFI_RX_PACKET_POOL_COUNT, default 20 buffers) and is shared by WHD&amp;#39;s whd_host_buffer_get callback for both transmit and receive. Once enough send failures have leaked the pool dry, airoc_wifi_host_buffer_get() returns WHD_BUFFER_ALLOC_FAIL for all subsequent allocations, so both transmit and the WHD-driven receive path fail and Wi-Fi connectivity is lost until the device is rebooted.<br /> <br /> The leak occurs only on the transmit error path. A Wi-Fi-adjacent attacker can influence the conditions that cause synchronous send failures (for example by deauthenticating/disassociating the station while the local stack continues to attempt transmits), and ordinary transient failures over the device&amp;#39;s lifetime accumulate toward the same state. Reliable on-demand triggering is of high complexity and the impact is availability-only, but the resulting denial of service is permanent and non-recoverable without a reboot.<br /> <br /> The fix releases the buffer with airoc_wifi_buffer_release() on the failure branch, returning it to the pool. The commit also removes a redundant k_sem_give() in airoc_mgmt_disconnect(); because data-&gt;sema_common is a binary semaphore (limit 1) the duplicate give merely saturated at 1 and had no security impact.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read<br /> <br /> put_fifo_with_discard() acts as both producer and consumer on the kfifo:<br /> it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from<br /> the IRQ handler without synchronizing with snoop_file_read(), which also<br /> consumes via kfifo_to_user(). On SMP systems this concurrent access can<br /> leave (in - out) larger than the ring buffer, so __kfifo_to_user()&amp;#39;s clamp<br /> to (in - out) is ineffective and kfifo_copy_to_user() can attempt a<br /> copy_to_user() past the kmalloc-2k backing store:<br /> <br /> usercopy: Kernel memory exposure attempt detected from SLUB object<br /> &amp;#39;kmalloc-2k&amp;#39; (offset 0, size 2049)!<br /> kernel BUG at mm/usercopy.c!<br /> Call trace:<br /> usercopy_abort<br /> __check_heap_object<br /> __check_object_size<br /> kfifo_copy_to_user<br /> __kfifo_to_user<br /> snoop_file_read<br /> vfs_read<br /> <br /> Serialize kfifo access with a per-channel spinlock shared between the<br /> IRQ handler (producer) and the file reader (consumer). Annotate @fifo<br /> with __guarded_by(&amp;lock) and opt the driver into context analysis so the<br /> compiler enforces that all fifo access holds the lock.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NFS: Pin the &amp;#39;struct nfs_server&amp;#39; during a FREE_STATEID call<br /> <br /> Dan Aloni reports that he was able to hit a use-after-free bug if a<br /> FREE_STATEID operation gets delayed for whatever reason. Fix this by<br /> bumping the refcount of the &amp;#39;struct nfs_server&amp;#39; object for the duration<br /> of the FREE_STATEID so it doesn&amp;#39;t get cleaned up from underneath us<br /> while operations are still in flight.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sched_ext: Skip sub-disable teardown for never-linked sub-schedulers<br /> <br /> A sub-scheduler enable can fail before scx_link_sched() links the sched into<br /> the hierarchy, e.g. when the parent is already being disabled, and cleanup<br /> still runs the full scx_sub_disable().<br /> <br /> That is racy against root disable: drain_descendants() is the only ordering<br /> between a sub&amp;#39;s disable-time task walk and root disable&amp;#39;s all-task teardown,<br /> and an unlinked sub is invisible to it. Root&amp;#39;s teardown can thus run between<br /> the never-linked sub&amp;#39;s drain and its walk, exiting every task to no<br /> scheduler.<br /> <br /> The walk then trips the membership WARN and re-homes the exited tasks onto<br /> the dying hierarchy, a use-after-free.<br /> <br /> Skip the cgroup ownership reset and the task walk if @sch was never linked,<br /> indicated by the empty -&gt;sibling as unlinking only happens later in the same<br /> function. The membership WARN remains valid: a linked sub is always waited<br /> on by an ancestor&amp;#39;s drain.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Check for tg ops in dce110_set_avmute<br /> <br /> Some older DCE timing generators do not implement is_tg_enabled in<br /> their ops table. Calling it unconditionally when waiting for AV mute<br /> frames causes a NULL pointer dereference on Southern Islands dGPUs<br /> when turning the display off over HDMI.<br /> <br /> Check that tg and the required ops exist before waiting for frames.<br /> <br /> (cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock<br /> <br /> Locking is disabled in the regmap config as this driver uses its own<br /> lock. This means that all calls to regmap functions (read or write) must<br /> hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do<br /> this, and it was therefore possible that multiple threads could cause an<br /> incorrect register to be read/written.<br /> <br /> A previous patch partly fixed this, but only protected the write to the<br /> interrupt mask register, and not the read from the direction register.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()<br /> <br /> Two error paths in amdxdna_insert_pages() called vma-&gt;vm_ops-&gt;close(vma)<br /> before returning an error code to the caller. This is incorrect:<br /> amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling<br /> amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo<br /> that registration. Calling vm_ops-&gt;close() manually — which drops the<br /> shmem pages_pin_count and the GEM object reference that backs the VMA —<br /> before the mmap syscall has even returned causes those resources to be<br /> released while the VMA is still alive. The kernel VMA teardown will call<br /> vm_ops-&gt;close() a second time when the process later unmaps the range,<br /> producing a reference count underflow.<br /> <br /> Replace both hard-error returns with a deferred-fault approach that keeps<br /> the VMA alive and retries page insertion through the HMM range-fault path.