Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/pci: Latch disable_idle_d3 per device<br /> <br /> When disable_idle_d3 was introduced in vfio-pci, it directly manipulated<br /> the device power state with pci_set_power_state(). There were no<br /> refcounts to maintain or balanced operations, we could unconditionally<br /> bring the device to D0 and conditionally move it to D3hot. Therefore<br /> the module parameter was made writable.<br /> <br /> Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to<br /> vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect<br /> of the module parameter was nullified. The parameter value could still<br /> be changed through sysfs, but the vfio-pci driver latched the values<br /> into vfio-pci-core globals at module init. Loading the vfio-pci module,<br /> or unloading and reloading, with non-default or different values could<br /> change the globals relative to existing devices bound to vfio-pci<br /> variant drivers.<br /> <br /> Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the<br /> unused device into low power state with runtime PM"), which marks the<br /> point where power states became refcounted. PM get and put operations<br /> need to be balanced, but the same module operations noted above can<br /> change the global variables relative to those devices already bound to<br /> vfio-pci variant drivers. This introduces a window where PM operations<br /> can now become unbalanced.<br /> <br /> To resolve this with a narrow footprint for stable backports, the<br /> disable_idle_d3 flag is latched into the vfio_pci_core_device at the<br /> time of initialization, such that the device always operates with a<br /> consistent value.<br /> <br /> NB. vfio_pci_dev_set_try_reset() now unconditionally raises the<br /> runtime PM usage count around bus reset to account for disable_idle_d3<br /> becoming a per-device rather than global flag. When this flag is set,<br /> the additional get/put pair is harmless and allows continued use of the<br /> shared vfio_pci_dev_set_pm_runtime_get() helper.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled<br /> <br /> The architecture updates the cpu_mask in a domain&amp;#39;s header to track which<br /> online CPUs are associated with the domain. When this mask becomes empty<br /> the architecture initiates offline of the domain that includes calling<br /> on resctrl fs to offline the domain. If it is a monitoring domain in<br /> which LLC occupancy is tracked resctrl fs forces the limbo handler to<br /> clear all busy RMID state associated with the domain.<br /> <br /> The limbo handler always reads the current event value associated with a<br /> busy RMID irrespective of it being checked as part of regular "is it still<br /> busy" check or whether it will be forced released anyway. When reading an<br /> RMID on a system with SNC enabled the "logical RMID" is converted to the<br /> "physical RMID" and this conversion requires the NUMA node ID of the<br /> resctrl monitoring domain that is in turn determined by querying the NUMA<br /> node ID of any CPU belonging to the monitoring domain.<br /> <br /> When the monitoring domain is going offline its cpu_mask is empty causing<br /> the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as<br /> argument resulting in an out-of-bounds access.<br /> <br /> Refactor the limbo handler to skip reading the RMID when the RMID will<br /> just be forced to no longer be dirty in the domain anyway. Add a safety<br /> check to the architecture&amp;#39;s RMID reader to protect against this scenario.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: usb-audio: avoid kobject path lookup in DualSense match<br /> <br /> The DualSense jack-detection input handler verifies that a matching input<br /> device belongs to the same physical controller by building kobject path<br /> strings for both the input device and the USB audio device, then comparing<br /> the path prefix.<br /> <br /> This was observed when a weak physical connection caused the controller<br /> to rapidly disconnect and reconnect. During that repeated hotplug,<br /> snd_dualsense_ih_match() can run while the controller&amp;#39;s USB device is<br /> being disconnected. kobject_get_path() walks ancestor kobjects and<br /> dereferences their names; if the USB device kobject name is no longer<br /> valid, this can fault in strlen():<br /> <br /> RIP: 0010:strlen+0x10/0x30<br /> Call Trace:<br /> kobject_get_path+0x34/0x150<br /> snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]<br /> input_register_device+0x566/0x6a0<br /> ps_probe+0xb89/0x1590 [hid_playstation]<br /> <br /> The same ownership check can be done without building kobject path<br /> strings. The input device is parented below the HID device, USB interface<br /> and USB device, so walking the input device parent chain and comparing<br /> against the mixer USB device preserves the check without dereferencing<br /> kobject names during disconnect.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()<br /> <br /> snd_seq_event_dup() copies an incoming event into a pool cell and, in<br /> the UMP-enabled build, clears the trailing cell-&gt;ump.raw.extra word that<br /> the memcpy() did not cover. The guard deciding whether to clear it<br /> compares the copied size against sizeof(cell-&gt;event):<br /> <br /> memcpy(&amp;cell-&gt;ump, event, size);<br /> if (size event))<br /> cell-&gt;ump.raw.extra = 0;<br /> <br /> For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==<br /> sizeof(cell-&gt;event), so the condition is false and the extra word keeps<br /> stale data. The cell pool is allocated with kvmalloc() (not zeroed) and<br /> cells are reused via a free list, so that word holds uninitialised heap<br /> or leftover event data.<br /> <br /> When such a cell is delivered to a UMP client (client-&gt;midi_version &gt; 0)<br /> that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it<br /> unconverted -- snd_seq_read() reads it out as the larger struct<br /> snd_seq_ump_event and copies the stale word to user space, a 4-byte<br /> kernel heap infoleak to an unprivileged /dev/snd/seq client.<br /> <br /> Compare against sizeof(cell-&gt;ump) instead, so the trailing word is zeroed<br /> for every event shorter than the UMP cell.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: ice1712: check snd_ctl_new1() return value<br /> <br /> snd_ctl_new1() can return NULL when memory allocation fails. The<br /> ice1712 driver calls snd_ctl_new1() without checking the return value<br /> before dereferencing the pointer in multiple places (ice1712.c,<br /> ice1724.c, aureon.c), which can lead to NULL pointer dereferences.<br /> <br /> Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any<br /> fails.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: hda/cs35l41: Fix firmware load work teardown<br /> <br /> cs35l41_hda creates ALSA controls whose private data points at the<br /> cs35l41_hda object. The firmware load control can also queue<br /> fw_load_work.<br /> <br /> Those controls are not removed on component unbind, and device remove<br /> only cancels fw_load_work through cs35l41_remove_dsp(). That helper is<br /> skipped when halo_initialized is false. With firmware_autostart<br /> disabled, a firmware load can be requested before the DSP has been<br /> initialized. If the component or device is removed before the queued<br /> work runs, the worker can run after teardown and dereference driver<br /> state that is no longer valid.<br /> <br /> Track the created controls and remove them on unbind so no new control<br /> callback can reach the driver data or queue more work. Then cancel<br /> fw_load_work to drain any request that was already queued. Also cancel<br /> the work unconditionally during device remove before runtime PM teardown.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: gus: check snd_ctl_new1() return value<br /> <br /> snd_ctl_new1() can return NULL when memory allocation fails.<br /> snd_gf1_pcm_volume_control() does not check the return value before<br /> dereferencing kctl-&gt;id.index, which can lead to a NULL pointer<br /> dereference.<br /> <br /> Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: firewire: isight: bound the sample count to the packet payload<br /> <br /> isight_packet() takes the frame count from the device iso packet and<br /> checks it only against the device claimed iso length.<br /> <br /> count = be32_to_cpu(payload-&gt;sample_count);<br /> if (likely(count samples, count);<br /> <br /> length is the iso header data_length. It can be up to 0xffff. So the<br /> gate allows a count up to about 16379. isight_samples() then copies<br /> count frames out of payload-&gt;samples into the PCM DMA buffer.<br /> <br /> payload-&gt;samples holds only 2 * MAX_FRAMES_PER_PACKET values. The<br /> device multiplexes two samples per frame. A count past<br /> MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer<br /> size writes past runtime-&gt;dma_area. The smallest PCM buffer is larger<br /> than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET<br /> keeps both the read and the write in range.<br /> <br /> A malicious or faulty Apple iSight on the FireWire bus reaches this<br /> during a normal capture.<br /> <br /> Add the MAX_FRAMES_PER_PACKET bound to the gate.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rust_binder: use a u64 stride when cleaning up the offsets array<br /> <br /> Allocation&amp;#39;s Drop walks the offsets array (binder_size_t = u64 entries),<br /> cleaning up the objects, but it used usize instead of u64 for both the<br /> stride and the per-entry read.<br /> <br /> On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels<br /> it walks the 8-byte entries in 4-byte steps, iterating an N-entry array<br /> 2N times, and reads the always-zero high word as offset 0, cleaning up<br /> the object at offset 0 N extra times. As a result the referenced node or<br /> handle ends up with a lower reference count than it actually has (a<br /> refcount over-decrement), and binder&amp;#39;s reference accounting is corrupted;<br /> for example, the owner can be notified of a strong reference release<br /> (BR_RELEASE) even though references still remain.<br /> <br /> Change the stride to u64, and read each entry as a u64, narrowing it to<br /> usize with try_into().<br /> <br /> On 32-bit ARM, when this over-decrement would drive a count below zero,<br /> the driver&amp;#39;s existing refcount guard refuses it and fires:<br /> <br /> rust_binder: Failure: refcount underflow!

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> binder: fix UAF in binder_free_transaction()<br /> <br /> In binder_free_transaction(), the t-&gt;to_proc is read under the t-&gt;lock.<br /> However, once the t-&gt;lock is dropped, the to_proc can die in parallel.<br /> This leads to a use-after-free error when we attempt to acquire its<br /> inner lock right afterwards:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0<br /> Write of size 4 at addr ffff00001125da70 by task B/672<br /> <br /> CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT<br /> Hardware name: linux,dummy-virt (DT)<br /> Call trace:<br /> _raw_spin_lock+0xe4/0x1a0<br /> binder_free_transaction+0x8c/0x320<br /> binder_send_failed_reply+0x21c/0x2f8<br /> binder_thread_release+0x488/0x7e0<br /> binder_ioctl+0x12c0/0x29a0<br /> [...]<br /> <br /> Allocated by task 675:<br /> __kmalloc_cache_noprof+0x174/0x444<br /> binder_open+0x118/0xb70<br /> do_dentry_open+0x374/0x1040<br /> vfs_open+0x58/0x3bc<br /> [...]<br /> <br /> Freed by task 212:<br /> __kasan_slab_free+0x58/0x80<br /> kfree+0x1a0/0x4a4<br /> binder_proc_dec_tmpref+0x32c/0x5e0<br /> binder_deferred_func+0xc48/0x104c<br /> process_one_work+0x53c/0xbc0<br /> [...]<br /> ==================================================================<br /> <br /> To prevent this, pin the target thread (t-&gt;to_thread) to guarantee the<br /> target process remains alive. Undelivered transactions without a target<br /> thread are already safe, as the target process can only be the current<br /> context in those paths.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> binder: fix UAF in binder_thread_release()<br /> <br /> When a thread exits, binder_thread_release() walks its transaction stack<br /> to clear the t-&gt;from and t-&gt;to_proc that correspond with the exiting<br /> thread. However, a process dying in parallel might attempt to kfree some<br /> of these transactions. And if one of them has no associated t-&gt;to_proc,<br /> the t-&gt;to_proc-&gt;inner_lock will not be acquired.<br /> <br /> This means that transaction accesses in binder_thread_release() after<br /> t-&gt;to_proc has been cleared might race with binder_free_transaction()<br /> and cause a use-after-free error as reported by KASAN:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798<br /> Write of size 8 at addr ffff000016627500 by task X/715<br /> <br /> CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT<br /> Hardware name: linux,dummy-virt (DT)<br /> Call trace:<br /> binder_thread_release+0x5d0/0x798<br /> binder_ioctl+0x12c0/0x299c<br /> [...]<br /> <br /> Allocated by task 717 on cpu 18 at 67.267803s:<br /> __kasan_kmalloc+0xa0/0xbc<br /> __kmalloc_cache_noprof+0x174/0x444<br /> binder_transaction+0x554/0x8150<br /> binder_thread_write+0xa30/0x4354<br /> binder_ioctl+0x20f0/0x299c<br /> [...]<br /> <br /> Freed by task 202 on cpu 18 at 90.416221s:<br /> __kasan_slab_free+0x58/0x80<br /> kfree+0x1a0/0x4a4<br /> binder_free_transaction+0x150/0x294<br /> binder_send_failed_reply+0x398/0x6d8<br /> binder_release_work+0x3e4/0x4ec<br /> binder_deferred_func+0xbd8/0x104c<br /> [...]<br /> ==================================================================<br /> <br /> In order to avoid this, make sure that binder_free_transaction() reads<br /> the t-&gt;to_proc under the transaction lock. This will serialize the<br /> transaction release with the accesses in binder_thread_release(). Plus,<br /> it matches the documented locking rules for @to_proc.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btusb: fix use-after-free on marvell probe failure<br /> <br /> Make sure to stop any TX URBs submitted during Marvell OOB wakeup<br /> configuration on later probe failures to avoid use-after-free in the<br /> completion callback.<br /> <br /> This issue was reported by Sashiko while reviewing a fix for a wakeup<br /> source leak in the btusb probe errors paths.