Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> posix-cpu-timers: Prevent UAF caused by non-leader exec() race<br /> <br /> Wongi and Jungwoo decoded and reported a non-leader exec() related race<br /> which can result in an UAF:<br /> <br /> sys_timer_delete() exec()<br /> posix_cpu_timer_del()<br /> // Observes old leader<br /> p = pid_task(pid, pid_type); de_thread()<br /> switch_leader();<br /> release_task(old_leader)<br /> __exit_signal(old_leader)<br /> sighand = lock(old_leader, sighand);<br /> posix_cpu_timers*_exit();<br /> sighand = lock_task_sighand(p) unhash_task(old_leader);<br /> sh = lock(p, sighand) old_leader-&gt;sighand = NULL;<br /> unlock(sighand);<br /> (p-&gt;sighand == NULL)<br /> unlock(sh)<br /> return NULL;<br /> <br /> // Returns without action<br /> if(!sighand)<br /> return 0;<br /> free_posix_timer();<br /> <br /> This is "harmless" unless the deleted timer was armed and enqueued in<br /> p-&gt;signal because on exec() a TGID targeted timer is inherited.<br /> <br /> As sys_timer_delete() freed the underlying posix timer object<br /> run_posix_cpu_timers() or any timerqueue related add/delete operations on<br /> other timers will access the freed object&amp;#39;s timerqueue node, which results<br /> in an UAF.<br /> <br /> There is a similar problem vs. posix_cpu_timer_set(). For regular posix<br /> timers it just transiently returns -ESRCH to user space, but for the use<br /> case in do_cpu_nanosleep() it&amp;#39;s the same UAF just that the k_itimer is<br /> allocated on the stack.<br /> <br /> Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops<br /> to expire.<br /> <br /> While debating solutions Frederic pointed out another problem:<br /> <br /> posix_cpu_timer_del(tmr)<br /> __exit_signal(p)<br /> posix_cpu_timers*_exit(p);<br /> unhash_task(p);<br /> p-&gt;sighand = NULL;<br /> sh = lock_task_sighand(p)<br /> sighand = p-&gt;sighand;<br /> if (!sighand)<br /> return NULL;<br /> lock(sighand);<br /> <br /> if (!sh)<br /> WARN_ON_ONCE(timer_queued(tmr));<br /> <br /> On weakly ordered architectures it is not guaranteed that<br /> posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()<br /> when p-&gt;sighand is observed as NULL, which means the WARN() can be a false<br /> positive.<br /> <br /> Solve these issues by:<br /> <br /> 1) Changing the store in __exit_signal() to smp_store_release().<br /> <br /> 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path<br /> of lock_task_sighand().<br /> <br /> 3) Creating a helper function for looking up the task and locking sighand<br /> which does not return when sighand == NULL. Instead it retries the<br /> task lookup and only if that fails it gives up.<br /> <br /> 4) Using that helper in the three affected functions.<br /> <br /> #1/#2 ensures that the reader side which observes sighand == NULL also<br /> observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()<br /> and the ones in unhash_task().<br /> <br /> #3 ensures that the above described non-leader exec() situation is handled<br /> gracefully. When the task lookup returns the old leader, but sighand ==<br /> NULL then it retries. In the non-leader exec() case the subsequent task<br /> lookup will observe the new leader due to #1/#2. In normal exit() scenarios<br /> the subsequent lookup fails.<br /> <br /> When the task lookup fails, the function also checks whether the timer is<br /> still enqueued and issues a warning if that&amp;#39;s the case. Unfortunately there<br /> is nothing which can be done about it, but as the task is already not<br /> longer visible the timer should not be accessed anymore. This check also<br /> requires memory ordering, which is not provided when the first lookup<br /> fails. To achieve that the check is preceeded by a smp_rmb() which pairs<br /> with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that<br /> the stores in posix_cpu_timers*_exit() are visible.<br /> <br /> The history of the non-leader exec() issue goes back to the early days of<br /> posix CPU timers, which stored a pointer to the group leader task in the<br /> timer. That obviously fails when a non-leader exec() switches the leader.<br /> commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems<br /> with mt exec") added a temporary workaround for that in 2010 which surv<br /> ---truncated---

*** Pendiente de traducción *** ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.

*** Pendiente de traducción *** proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.

*** Pendiente de traducción *** Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.

*** Pendiente de traducción *** fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

*** Pendiente de traducción *** SQL Injection vulnerability in ClickHouse Server Versions

*** Pendiente de traducción *** undici&amp;#39;s setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

*** Pendiente de traducción *** A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

*** Pendiente de traducción *** Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted

*** Pendiente de traducción *** undici&amp;#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&amp;#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

*** Pendiente de traducción *** @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option.

*** Pendiente de traducción *** An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.