Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: wacom: Fix OOB write in wacom_hid_set_device_mode()<br /> <br /> wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE<br /> usage is always located in the first field (field[0]) of the feature report.<br /> However, a device can specify HID_DG_INPUTMODE in a different field.<br /> <br /> If HID_DG_INPUTMODE is in a field other than the first one and the first<br /> field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,<br /> this leads to an out-of-bounds write to r-&gt;field[0]-&gt;value.<br /> <br /> Fix this by storing the field index of HID_DG_INPUTMODE in &amp;#39;struct<br /> hid_data&amp;#39; during feature mapping. In wacom_hid_set_device_mode(), use<br /> this stored field index to access the correct field and add bounds<br /> checks to ensure both the field index and the value index are within<br /> valid ranges before writing.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ip6: vti: Use ip6_tnl.net in vti6_changelink().<br /> <br /> ip netns add ns1<br /> ip netns add ns2<br /> ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7<br /> ip -n ns1 link set vti6_test netns ns2<br /> ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9<br /> ip netns del ns2<br /> ip netns del ns1<br /> [ 132.495484] ------------[ cut here ]------------<br /> [ 132.497609] kernel BUG at net/core/dev.c:12376!<br /> <br /> Commit 61220ab34948 ("vti6: Enable namespace changing") dropped<br /> NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then<br /> move through IFLA_NET_NS_FD. After the move dev_net(dev) points<br /> at the new netns while t-&gt;net stays at the creation netns.<br /> <br /> vti6_changelink() and vti6_update() still use dev_net(dev) and<br /> dev_net(t-&gt;dev). They unlink from one per netns hash and relink<br /> into another. The creation netns is left with a stale entry.<br /> cleanup_net() of that netns later walks freed memory.<br /> <br /> Reachable from an unprivileged user namespace (unshare --user<br /> --map-root-user --net). Cross tenant scope on container hosts.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname<br /> <br /> A reader in l2tp_session_get_by_ifname() can return a pointer to a<br /> session whose refcount has reached zero. The getter takes its<br /> reference with plain refcount_inc(), but every other session getter<br /> in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the<br /> corresponding _get_next variants) uses refcount_inc_not_zero()<br /> because the IDR/RCU lookup can race with refcount_dec_and_test() -&gt;<br /> l2tp_session_free() -&gt; kfree_rcu(). The ifname getter is the only<br /> outlier; the inconsistency was raised on-list after 979c017803c4<br /> ("l2tp: use list_del_rcu in l2tp_session_unhash").<br /> <br /> A reader inside rcu_read_lock_bh() that matches session-&gt;ifname can<br /> be preempted between the strcmp() and the refcount_inc(). If the<br /> last reference drops on another CPU in that window, the reader&amp;#39;s<br /> refcount_inc() runs on a counter that has reached zero. refcount_t<br /> catches the addition-on-zero, prints "refcount_t: addition on 0;<br /> use-after-free", saturates the counter, and returns the saturated<br /> pointer to the caller. Session memory is held live by the in-flight<br /> RCU read section, but the kfree_rcu() callback queued from<br /> l2tp_session_free() will free it once the grace period closes; a<br /> caller that dereferences the returned session past that point hits<br /> a slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU<br /> sleeping lock and the preemption window is real; on stock PREEMPT<br /> kernels local_bh_disable() is a preempt_count increment that closes<br /> the cross-CPU race in practice (see below).<br /> <br /> Use refcount_inc_not_zero() and continue the list walk on failure,<br /> matching the other session getters in the file. The ifname getter<br /> is the only session getter in net/l2tp/ that still uses the bare<br /> refcount_inc() pattern; this change restores file-internal<br /> consistency. The success path is unchanged.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> USB: serial: belkin_sa: validate interrupt status length<br /> <br /> The Belkin interrupt callback treats interrupt data as a four-byte<br /> status report and reads LSR/MSR fields at offsets 2 and 3. The<br /> interrupt-in buffer length is derived from endpoint wMaxPacketSize, and<br /> short interrupt transfers may complete successfully with a smaller<br /> actual_length.<br /> <br /> Check the completed interrupt packet length before parsing status<br /> fields so short interrupt endpoints and short successful packets are<br /> ignored instead of causing out-of-bounds or stale status-byte reads.<br /> <br /> KASAN report as below:<br /> <br /> BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()<br /> Read of size 1<br /> Call trace:<br /> belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)<br /> __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)<br /> dummy_timer() (?:?)

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: usbtmc: check URB actual_length for interrupt-IN notifications<br /> <br /> USBTMC devices can use an optional interrupt endpoint for notification<br /> messages. These typically contain two-byte headers indicating the<br /> payload format, but the driver does not check if these headers are<br /> present before accessing the data buffers. In cases where the URB<br /> actual_length is not enough to fit these headers, the driver will either<br /> cause an out-of-bounds read, or consume stale leftover data from a<br /> previous notification.<br /> <br /> Fix by checking if actual_data contains enough bytes for the headers,<br /> otherwise resubmit URB to the interrupt endpoint.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usbip: vudc: Fix use after free bug in vudc_remove due to race condition<br /> <br /> This patch follows up Zheng Wang&amp;#39;s 2023 report of a use-after-free in<br /> vudc_remove(). The original thread stalled on Shuah Khan&amp;#39;s request for<br /> runtime testing of the unplug/unbind path. This patch supplies that<br /> testing and keeps Zheng&amp;#39;s original fix shape.<br /> <br /> In vudc_probe(), v_init_timer() binds udc-&gt;tr_timer.timer to v_timer().<br /> usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer().<br /> vudc_remove() can then free the containing struct vudc while the timer is<br /> still pending or executing.<br /> <br /> KASAN confirms the race on an unpatched x86_64 QEMU guest with<br /> CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop<br /> that repeatedly writes a socket fd to usbip_sockfd, closes the socket<br /> pair, and unbinds/rebinds usbip-vudc.0:<br /> <br /> BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0<br /> Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239<br /> Allocated by task 239:<br /> vudc_probe+0x4d/0xaa0<br /> Freed by task 239:<br /> kfree+0x18f/0x520<br /> device_release_driver_internal+0x388/0x540<br /> unbind_store+0xd9/0x100<br /> <br /> This lands in the timer core rather than v_timer() itself because the<br /> embedded timer_list is being walked after its containing struct vudc has<br /> already been freed. The underlying lifetime bug is the same one Zheng<br /> reported.<br /> <br /> With v_stop_timer() called from vudc_remove() and the timer deleted<br /> synchronously, the same harness completed 5000 bind/unbind iterations<br /> with no KASAN report.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: musb: omap2430: Fix use-after-free in omap2430_probe()<br /> <br /> In omap2430_probe(), of_node_put(np) is called prematurely before the<br /> last access to np, leading to a use-after-free if the node&amp;#39;s reference<br /> count drops to zero. Move the of_node_put() calls after the last use of<br /> np in both the success and error paths.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory<br /> <br /> uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in<br /> probe(), but then calls kfree(udev) both on the probe() error path<br /> (label out_free) and again in remove().<br /> <br /> Because devm_kzalloc() allocations are devres-managed and are freed<br /> automatically when the device is detached (including after a failing<br /> probe() and during driver unbind), the explicit kfree() can lead to a<br /> double free.<br /> <br /> If probe() fails after devm_kzalloc(), the error path frees udev and<br /> devres cleanup will free it again when the core unwinds the partially<br /> bound device. On normal driver removal, remove() frees udev and devres<br /> will free it again when the device is detached.<br /> <br /> This issue was identified by a static analysis tool I developed and<br /> confirmed by manual review. Fix by removing the manual kfree() calls<br /> and dropping the now-unused label.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem<br /> <br /> When a configuration file provides an object size that is larger than the<br /> driver&amp;#39;s known mxt_obj_size(object), the driver intends to discard the<br /> extra bytes.<br /> <br /> The loop iterates using for (i = 0; i mxt_obj_size(object))<br /> continue;<br /> <br /> Since i is a 0-based index, the valid indices for the object are 0 through<br /> mxt_obj_size(object) - 1.<br /> <br /> When i == mxt_obj_size(object), the condition evaluates to false, and the<br /> code processes the byte instead of discarding it.<br /> <br /> This causes the code to calculate byte_offset = reg + i - cfg-&gt;start_ofs<br /> and writes the byte there, overwriting exactly one byte of the adjacent<br /> instance or object.<br /> <br /> Update the boundary check to skip extra bytes correctly by using &gt;=.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops<br /> <br /> Commit d07b26f39246 ("ksmbd: require minimum ACE size in<br /> smb_check_perm_dacl()") introduced a transposed bounds check:<br /> <br /> if (offsetof(struct smb_ace, sid) + aces_size

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dma-buf: fix UAF in dma_buf_fd() tracepoint<br /> <br /> Once FD_ADD() returns, the fd is live in the file descriptor table<br /> and a thread sharing that table can close() it before DMA_BUF_TRACE()<br /> runs. The close drops the last reference, __fput() frees the dma_buf,<br /> and the tracepoint then dereferences dmabuf to take dmabuf-&gt;name_lock<br /> -- slab-use-after-free.<br /> <br /> Split FD_ADD() back into get_unused_fd_flags() + fd_install() and<br /> emit the tracepoint between them. While the fdtable slot is reserved<br /> with a NULL file pointer, a racing close() returns -EBADF without<br /> entering __fput(), so the dma_buf stays alive across the trace. Same<br /> approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dma_buf_put()<br /> tracepoint").<br /> <br /> This undoes the FD_ADD() conversion done in commit 34dfce523c90<br /> ("dma: convert dma_buf_fd() to FD_ADD()"); FD_ADD() has no place to<br /> hook the tracepoint safely.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: iptfs: reset runtime state when cloning SAs<br /> <br /> iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This<br /> copies runtime objects which must not be shared with the original SA,<br /> including the embedded sk_buff_head, hrtimers, spinlock, and in-flight<br /> reassembly/reorder state.<br /> <br /> If xfrm_state_migrate() fails after clone_state() but before the later<br /> init_state() call has reinitialized those fields, the cloned state can be<br /> destroyed by xfrm_state_gc_task() with list and timer state copied from the<br /> original SA. With queued packets this lets the clone splice and free skbs<br /> owned by the original IPTFS queue, leading to use-after-free and<br /> double-free reports in iptfs_destroy_state() and skb release paths.<br /> <br /> Reinitialize the clone&amp;#39;s runtime state before publishing it through<br /> x-&gt;mode_data. Because clone_state() now publishes a destroyable mode_data<br /> object before init_state(), take the mode callback module reference there.<br /> Avoid taking it again from __iptfs_init_state() for the same object.