Vulnerabilidades

*** Pendiente de traducción *** Rejected reason: This CVE is a duplicate of another CVE.

*** Pendiente de traducción *** BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.

*** Pendiente de traducción *** A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

*** Pendiente de traducción *** In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.

*** Pendiente de traducción *** A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.

*** Pendiente de traducción *** bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: rt2x00usb: fix devres lifetime<br /> <br /> USB drivers bind to USB interfaces and any device managed resources<br /> should have their lifetime tied to the interface rather than parent USB<br /> device. This avoids issues like memory leaks when drivers are unbound<br /> without their devices being physically disconnected (e.g. on probe<br /> deferral or configuration changes).<br /> <br /> Fix the USB anchor lifetime so that it is released on driver unbind.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: clear trailing padding in build_polexpire()<br /> <br /> build_expire() clears the trailing padding bytes of struct<br /> xfrm_user_expire after setting the hard field via memset_after(),<br /> but the analogous function build_polexpire() does not do this for<br /> struct xfrm_user_polexpire.<br /> <br /> The padding bytes after the __u8 hard field are left<br /> uninitialized from the heap allocation, and are then sent to<br /> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,<br /> leaking kernel heap memory contents.<br /> <br /> Add the missing memset_after() call, matching build_expire().

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nft_ct: fix use-after-free in timeout object destroy<br /> <br /> nft_ct_timeout_obj_destroy() frees the timeout object with kfree()<br /> immediately after nf_ct_untimeout(), without waiting for an RCU grace<br /> period. Concurrent packet processing on other CPUs may still hold<br /> RCU-protected references to the timeout object obtained via<br /> rcu_dereference() in nf_ct_timeout_data().<br /> <br /> Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer<br /> freeing until after an RCU grace period, matching the approach already<br /> used in nfnetlink_cttimeout.c.<br /> <br /> KASAN report:<br /> BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0<br /> Read of size 4 at addr ffff8881035fe19c by task exploit/80<br /> <br /> Call Trace:<br /> nf_conntrack_tcp_packet+0x1381/0x29d0<br /> nf_conntrack_in+0x612/0x8b0<br /> nf_hook_slow+0x70/0x100<br /> __ip_local_out+0x1b2/0x210<br /> tcp_sendmsg_locked+0x722/0x1580<br /> __sys_sendto+0x2d8/0x320<br /> <br /> Allocated by task 75:<br /> nft_ct_timeout_obj_init+0xf6/0x290<br /> nft_obj_init+0x107/0x1b0<br /> nf_tables_newobj+0x680/0x9c0<br /> nfnetlink_rcv_batch+0xc29/0xe00<br /> <br /> Freed by task 26:<br /> nft_obj_destroy+0x3f/0xa0<br /> nf_tables_trans_destroy_work+0x51c/0x5c0<br /> process_one_work+0x2c4/0x5a0

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()<br /> <br /> After commit 1618aa3c2e01 ("btrfs: simplify return variables in<br /> lookup_extent_data_ref()"), the err and ret variables were merged into<br /> a single ret variable. However, when btrfs_next_leaf() returns 0<br /> (success), ret is overwritten from -ENOENT to 0. If the first key in<br /> the next leaf does not match (different objectid or type), the function<br /> returns 0 instead of -ENOENT, making the caller believe the lookup<br /> succeeded when it did not. This can lead to operations on the wrong<br /> extent tree item, potentially causing extent tree corruption.<br /> <br /> Fix this by returning -ENOENT directly when the key does not match,<br /> instead of relying on the ret variable.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: uinput - fix circular locking dependency with ff-core<br /> <br /> A lockdep circular locking dependency warning can be triggered<br /> reproducibly when using a force-feedback gamepad with uinput (for<br /> example, playing ELDEN RING under Wine with a Flydigi Vader 5<br /> controller):<br /> <br /> ff-&gt;mutex -&gt; udev-&gt;mutex -&gt; input_mutex -&gt; dev-&gt;mutex -&gt; ff-&gt;mutex<br /> <br /> The cycle is caused by four lock acquisition paths:<br /> <br /> 1. ff upload: input_ff_upload() holds ff-&gt;mutex and calls<br /> uinput_dev_upload_effect() -&gt; uinput_request_submit() -&gt;<br /> uinput_request_send(), which acquires udev-&gt;mutex.<br /> <br /> 2. device create: uinput_ioctl_handler() holds udev-&gt;mutex and calls<br /> uinput_create_device() -&gt; input_register_device(), which acquires<br /> input_mutex.<br /> <br /> 3. device register: input_register_device() holds input_mutex and<br /> calls kbd_connect() -&gt; input_register_handle(), which acquires<br /> dev-&gt;mutex.<br /> <br /> 4. evdev release: evdev_release() calls input_flush_device() under<br /> dev-&gt;mutex, which calls input_ff_flush() acquiring ff-&gt;mutex.<br /> <br /> Fix this by introducing a new state_lock spinlock to protect<br /> udev-&gt;state and udev-&gt;dev access in uinput_request_send() instead of<br /> acquiring udev-&gt;mutex. The function only needs to atomically check<br /> device state and queue an input event into the ring buffer via<br /> uinput_dev_event() -- both operations are safe under a spinlock<br /> (ktime_get_ts64() and wake_up_interruptible() do not sleep). This<br /> breaks the ff-&gt;mutex -&gt; udev-&gt;mutex link since a spinlock is a leaf in<br /> the lock ordering and cannot form cycles with mutexes.<br /> <br /> To keep state transitions visible to uinput_request_send(), protect<br /> writes to udev-&gt;state in uinput_create_device() and<br /> uinput_destroy_device() with the same state_lock spinlock.<br /> <br /> Additionally, move init_completion(&amp;request-&gt;done) from<br /> uinput_request_send() to uinput_request_submit() before<br /> uinput_request_reserve_slot(). Once the slot is allocated,<br /> uinput_flush_requests() may call complete() on it at any time from<br /> the destroy path, so the completion must be initialised before the<br /> request becomes visible.<br /> <br /> Lock ordering after the fix:<br /> <br /> ff-&gt;mutex -&gt; state_lock (spinlock, leaf)<br /> udev-&gt;mutex -&gt; state_lock (spinlock, leaf)<br /> udev-&gt;mutex -&gt; input_mutex -&gt; dev-&gt;mutex -&gt; ff-&gt;mutex (no back-edge)

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> seg6: separate dst_cache for input and output paths in seg6 lwtunnel<br /> <br /> The seg6 lwtunnel uses a single dst_cache per encap route, shared<br /> between seg6_input_core() and seg6_output_core(). These two paths<br /> can perform the post-encap SID lookup in different routing contexts<br /> (e.g., ip rules matching on the ingress interface, or VRF table<br /> separation). Whichever path runs first populates the cache, and the<br /> other reuses it blindly, bypassing its own lookup.<br /> <br /> Fix this by splitting the cache into cache_input and cache_output,<br /> so each path maintains its own cached dst independently.