Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms<br /> <br /> Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected<br /> platforms") replaced the dnv_board setup and exit callbacks with<br /> PTR_IF(false, ...), which evaluates to NULL. However, the three call<br /> sites in mid8250_probe() and mid8250_remove() unconditionally<br /> dereference these function pointers without NULL checks, causing a NULL<br /> pointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon<br /> D (ICX-D/CDF), or Snowridge (SNR) platform.<br /> <br /> Fix this by adding the missing NULL checks before calling the setup and<br /> exit callbacks.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> LoongArch: Fix address space mismatch in kexec command line lookup<br /> <br /> When searching the loaded segments for the "kexec" command line marker,<br /> the kexec_load(2) path (file_mode == 0) passes the user-space segment<br /> buffer straight to strncmp() through a bogus (char __user *) cast. This<br /> dereferences a user pointer in kernel context, which is wrong and is<br /> flagged by sparse:<br /> <br /> arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in<br /> argument 2 (different address spaces) @@ expected char const * @@ got<br /> char [noderef] __user *<br /> <br /> Here copy the marker-sized prefix of each segment into a small on-stack<br /> buffer with copy_from_user() before comparing, and skip segments that<br /> fault. The subsequent copy_from_user() that stages the full command line<br /> into the safe area is left unchanged.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: use kvzalloc to allocate struct dc<br /> <br /> struct dc has grown large over time (most of it the two inlined<br /> dc_scratch_space copies) and now sits close to the page allocator&amp;#39;s 4 MiB<br /> contiguous allocation limit. Its actual size is not fixed by the source<br /> alone, it also depends on the compiler and the .config, so it can easily<br /> cross 4 MiB, e.g. with a newer GCC or a config change.<br /> <br /> dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the<br /> request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,<br /> so the page allocator warns and returns NULL. dc_create() then fails, DM<br /> init fails and amdgpu probe aborts with -EINVAL:<br /> <br /> WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380<br /> dc_create+0x38/0x660 [amdgpu]<br /> amdgpu_dm_init+0x2d9/0x510 [amdgpu]<br /> dm_hw_init+0x1b/0x90 [amdgpu]<br /> amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]<br /> amdgpu_driver_load_kms+0x19/0x80 [amdgpu]<br /> amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]<br /> <br /> dc_create() then returns NULL and DM init fails, which aborts the whole<br /> GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block<br /> failed -22"), leaving the display unusable. The subsequent<br /> amdgpu_irq_put() warnings during teardown are just fallout of unwinding<br /> a half-initialized device.<br /> <br /> struct dc is a software-only bookkeeping structure that is never handed<br /> to hardware DMA and is only ever kept as an opaque pointer, so it does<br /> not require physically contiguous memory. Allocate it with kvzalloc()<br /> (and free it with kvfree()) so that the allocator can fall back to<br /> vmalloc() when a contiguous allocation of that size is not available,<br /> which also avoids the MAX_PAGE_ORDER warning entirely.<br /> <br /> v2:<br /> - Rebase to amd-staging-drm-next.<br /> <br /> (cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/imagination: Fit paired fragment job in the correct CCCB<br /> <br /> For geometry jobs with a paired fragment job, at the moment, the<br /> DRM scheduler&amp;#39;s prepare_job() callback:<br /> <br /> - checks for internal (driver) dependencies for the geometry job;<br /> - calls into pvr_queue_get_paired_frag_job_dep() to check for external<br /> dependencies for the fragment job (the two jobs are submitted together<br /> but the common scheduler code doesn&amp;#39;t know about it, so this needs to<br /> be done at this point in time);<br /> - calls into the prepare_job() callback again, but for the fragment job,<br /> to check its internal dependencies as well, passing the fragment job&amp;#39;s<br /> drm_sched_job and the geometry job&amp;#39;s drm_sched_entity / pvr_queue.<br /> <br /> The problem with the last step is that pvr_queue_prepare_job() doesn&amp;#39;t<br /> always take the mismatched fragment job and geometry queue into account,<br /> in particular when checking whether there is space for the fragment<br /> command to be submitted, so the code ends up checking for space in the<br /> geometry (i.e. wrong) CCCB.<br /> The rest of the nested prepare_job() callback happens to work fine at<br /> the moment as the other internal dependencies are not relevant for a<br /> paired fragment job.<br /> <br /> Move the initialisation of a paired fragment job&amp;#39;s done fence and CCCB<br /> fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct<br /> queue from the fragment job itself.<br /> <br /> This fixes cases where prepare_job() wrongly assumed that there was<br /> enough space for a paired fragment job in its own CCCB, unblocking<br /> run_job(), which then returned early without writing the full sequence<br /> of commands to the CCCB.<br /> <br /> The above lead to kernel warnings such as the following and potentially<br /> job timeouts (depending on waiters on the missing commands):<br /> <br /> [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63<br /> [ 552.421230] Modules linked in:<br /> [ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT<br /> [ 552.421625] Tainted: [W]=WARN<br /> [ 552.421637] Hardware name: Texas Instruments AM625 SK (DT)<br /> [ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]<br /> [ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]<br /> [ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]<br /> [ 552.421923] sp : ffff800084c47650<br /> [ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000<br /> [ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000<br /> [ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008<br /> [ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000<br /> [ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000<br /> [ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000<br /> [ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3<br /> [ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008<br /> [ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000<br /> [ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f<br /> [ 552.422316] Call trace:<br /> [ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)<br /> [ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]<br /> [ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr]<br /> [ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]<br /> [ 552.422623] process_one_work+0x520/0x1288<br /> [ 552.422657] worker_thread+0x3f0/0xb3c<br /> [ 552.422679] kthread+0x334/0x3d8<br /> [ 552.422706] ret_from_fork+0x10/0x20

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()<br /> <br /> A hotplug or link-loss event can tear down the MST topology<br /> (setting mgr-&gt;mst_state = false and mgr-&gt;mst_primary = NULL) concurrently<br /> with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check<br /> is already performed under mgr-&gt;lock, the condition is not a programming<br /> error but a valid race -- the topology was valid when the caller decided<br /> to call this function, but was torn down before the lock was acquired.<br /> <br /> Replace the drm_WARN_ON() with a graceful early return. This eliminates<br /> spurious kernel warnings and the resulting compositor crashes observed<br /> when connecting/disconnecting DP MST monitors, while keeping the correct<br /> behavior of doing nothing when MST is not active. A drm_dbg_mst() trace<br /> is added so the skipped probe remains observable under MST debug logging.<br /> <br /> The existing WARN_ON(mgr-&gt;mst_primary) in drm_dp_mst_topology_mgr_set_mst()<br /> already catches the case where the topology is initialized twice, so no<br /> diagnostic coverage is lost.

*** Pendiente de traducción *** A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a manipulation of the argument msisdn_len can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.2 is able to resolve this issue. This patch is called 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304. Upgrading the affected component is recommended.

*** Pendiente de traducción *** Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer&amp;#39;s security context when the context menu component is selected. This issue is fixed in version 8.9.7.

*** Pendiente de traducción *** Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra&amp;#39;s cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.

*** Pendiente de traducción *** Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra&amp;#39;s worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

*** Pendiente de traducción *** Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra&amp;#39;s core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

*** Pendiente de traducción *** calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

*** Pendiente de traducción *** calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.