Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdkfd: Fix kfd_process_device_init_vm error handling<br /> <br /> Should only destroy the ib_mem and let process cleanup worker to free<br /> the outstanding BOs. Reset the pointer in pdd-&gt;qpd structure, to avoid<br /> NULL pointer access in process destroy worker.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000010<br /> Call Trace:<br /> amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel+0x46/0xb0 [amdgpu]<br /> kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu]<br /> kfd_process_destroy_pdds+0x71/0x190 [amdgpu]<br /> kfd_process_wq_release+0x2a2/0x3b0 [amdgpu]<br /> process_one_work+0x2a1/0x600<br /> worker_thread+0x39/0x3d0

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: vt6655: fix some erroneous memory clean-up loops<br /> <br /> In some initialization functions of this driver, memory is allocated with<br /> &amp;#39;i&amp;#39; acting as an index variable and increasing from 0. The commit in<br /> "Fixes" introduces some clean-up codes in case of allocation failure,<br /> which free memory in reverse order with &amp;#39;i&amp;#39; decreasing to 0. However,<br /> there are some problems:<br /> - The case i=0 is left out. Thus memory is leaked.<br /> - In case memory allocation fails right from the start, the memory<br /> freeing loops will start with i=-1 and invalid memory locations will<br /> be accessed.<br /> <br /> One of these loops has been fixed in commit c8ff91535880 ("staging:<br /> vt6655: fix potential memory leak"). Fix the remaining erroneous loops.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dmaengine: hisilicon: Add multi-thread support for a DMA channel<br /> <br /> When we get a DMA channel and try to use it in multiple threads it<br /> will cause oops and hanging the system.<br /> <br /> % echo 100 &gt; /sys/module/dmatest/parameters/threads_per_chan<br /> % echo 100 &gt; /sys/module/dmatest/parameters/iterations<br /> % echo 1 &gt; /sys/module/dmatest/parameters/run<br /> [383493.327077] Unable to handle kernel paging request at virtual<br /> address dead000000000108<br /> [383493.335103] Mem abort info:<br /> [383493.335103] ESR = 0x96000044<br /> [383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits<br /> [383493.335107] SET = 0, FnV = 0<br /> [383493.335108] EA = 0, S1PTW = 0<br /> [383493.335109] FSC = 0x04: level 0 translation fault<br /> [383493.335110] Data abort info:<br /> [383493.335111] ISV = 0, ISS = 0x00000044<br /> [383493.364739] CM = 0, WnR = 1<br /> [383493.367793] [dead000000000108] address between user and kernel<br /> address ranges<br /> [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP<br /> [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump:<br /> loaded Tainted: GO 5.17.0-rc4+ #2<br /> [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT<br /> -SSBS BTYPE=--)<br /> [383493.465331] pc : vchan_tx_submit+0x64/0xa0<br /> [383493.469957] lr : vchan_tx_submit+0x34/0xa0<br /> <br /> This occurs because the transmission timed out, and that&amp;#39;s due<br /> to data race. Each thread rewrite channels&amp;#39;s descriptor as soon as<br /> device_issue_pending is called. It leads to the situation that<br /> the driver thinks that it uses the right descriptor in interrupt<br /> handler while channels&amp;#39;s descriptor has been changed by other<br /> thread. The descriptor which in fact reported interrupt will not<br /> be handled any more, as well as its tx-&gt;callback.<br /> That&amp;#39;s why timeout reports.<br /> <br /> With current fixes channels&amp;#39; descriptor changes it&amp;#39;s value only<br /> when it has been used. A new descriptor is acquired from<br /> vc-&gt;desc_issued queue that is already filled with descriptors<br /> that are ready to be sent. Threads have no direct access to DMA<br /> channel descriptor. In case of channel&amp;#39;s descriptor is busy, try<br /> to submit to HW again when a descriptor is completed. In this case,<br /> vc-&gt;desc_issued may be empty when hisi_dma_start_transfer is called,<br /> so delete error reporting on this. Now it is just possible to queue<br /> a descriptor for further processing.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mmc: wmt-sdmmc: fix return value check of mmc_add_host()<br /> <br /> mmc_add_host() may return error, if we ignore its return value, the memory<br /> that allocated in mmc_alloc_host() will be leaked and it will lead a kernel<br /> crash because of deleting not added device in the remove path.<br /> <br /> So fix this by checking the return value and goto error path which will call<br /> mmc_free_host(), besides, clk_disable_unprepare() also needs be called.

Jenkins 2.527 y anteriores, LTS 2.516.2 y anteriores no realiza una verificación de permisos en el panel lateral de una página intencionalmente accesible para usuarios que carecen del permiso General/Lectura, permitiendo a atacantes sin el permiso General/Lectura listar nombres de agentes a través de su widget de ejecutores del panel lateral.

Jenkins 2.527 y anteriores, LTS 2.516.2 y anteriores no realiza una verificación de permisos para el menú desplegable del perfil de usuario autenticado, permitiendo a los atacantes sin permiso de Overall/Read obtener información limitada sobre la configuración de Jenkins al listar las opciones disponibles en este menú (p. ej., si el Credentials plugin está instalado).

Jenkins 2.527 y anteriores, LTS 2.516.2 y anteriores no restringe ni transforma los caracteres que pueden insertarse desde contenido especificado por el usuario en mensajes de registro, permitiendo a los atacantes capaces de controlar el contenido de los mensajes de registro insertar caracteres de salto de línea, seguidos de mensajes de registro falsificados que pueden inducir a error a los administradores que revisan la salida del registro.

Open5GS v2.7.5, anterior al commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, es vulnerable a una desreferenciación de puntero NULL cuando se envía una solicitud HTTP POST multipart/related con un cuerpo HTTP vacío al SBI de AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM o UDR, lo que resulta en una denegación de servicio. Esto ocurre en la función parse_multipart en lib/sbi/message.c.

*** Pendiente de traducción *** An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter

*** Pendiente de traducción *** A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/update_student.php. Performing manipulation of the argument stud_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

*** Pendiente de traducción *** A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_student.php. Executing manipulation of the argument stud_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Cuando NeuVector ejecuta y finaliza un comando Java con parámetros de contraseña por NeuVector por violación de regla de proceso, la contraseña aparecerá en el registro de eventos de seguridad de NeuVector.