Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/ieee802154: don&amp;#39;t warn zero-sized raw_sendmsg()<br /> <br /> syzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],<br /> for PF_IEEE802154 socket&amp;#39;s zero-sized raw_sendmsg() request is hitting<br /> __dev_queue_xmit() with skb-&gt;len == 0.<br /> <br /> Since PF_IEEE802154 socket&amp;#39;s zero-sized raw_sendmsg() request was<br /> able to return 0, don&amp;#39;t call __dev_queue_xmit() if packet length is 0.<br /> <br /> ----------<br /> #include <br /> #include <br /> <br /> int main(int argc, char *argv[])<br /> {<br /> struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };<br /> struct iovec iov = { };<br /> struct msghdr hdr = { .msg_name = &amp;addr, .msg_namelen = sizeof(addr), .msg_iov = &amp;iov, .msg_iovlen = 1 };<br /> sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), &amp;hdr, 0);<br /> return 0;<br /> }<br /> ----------<br /> <br /> Note that this might be a sign that commit fd1894224407c484 ("bpf: Don&amp;#39;t<br /> redirect packets with invalid pkt_len") should be reverted, for<br /> skb-&gt;len == 0 was acceptable for at least PF_IEEE802154 socket.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()<br /> <br /> &amp;#39;vc_ctrl_req&amp;#39; is alloced in virtio_crypto_alg_skcipher_close_session(),<br /> and should be freed in the invalid ctrl_status-&gt;status error handling<br /> case. Otherwise there is a memory leak.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HSI: ssi_protocol: fix potential resource leak in ssip_pn_open()<br /> <br /> ssip_pn_open() claims the HSI client&amp;#39;s port with hsi_claim_port(). When<br /> hsi_register_port_event() gets some error and returns a negetive value,<br /> the HSI client&amp;#39;s port should be released with hsi_release_port().<br /> <br /> Fix it by calling hsi_release_port() when hsi_register_port_event() fails.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()<br /> <br /> If clk_hw_register() fails, the corresponding clk should not be<br /> unregistered.<br /> <br /> To handle errors from loops, clean up partial iterations before doing the<br /> goto. So add a clk_hw_unregister().<br /> Then use a while (--i &gt;= 0) loop in the unwind section.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mrp: introduce active flags to prevent UAF when applicant uninit<br /> <br /> The caller of del_timer_sync must prevent restarting of the timer, If<br /> we have no this synchronization, there is a small probability that the<br /> cancellation will not be successful.<br /> <br /> And syzbot report the fellowing crash:<br /> ==================================================================<br /> BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline]<br /> BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605<br /> Write at addr f9ff000024df6058 by task syz-fuzzer/2256<br /> Pointer tag: [f9], memory tag: [fe]<br /> <br /> CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008-<br /> ge01d50cbd6ee #0<br /> Hardware name: linux,dummy-virt (DT)<br /> Call trace:<br /> dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156<br /> dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline]<br /> show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163<br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106<br /> print_address_description mm/kasan/report.c:284 [inline]<br /> print_report+0x1a8/0x4a0 mm/kasan/report.c:395<br /> kasan_report+0x94/0xb4 mm/kasan/report.c:495<br /> __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320<br /> do_bad_area arch/arm64/mm/fault.c:473 [inline]<br /> do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749<br /> do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825<br /> el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367<br /> el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427<br /> el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576<br /> hlist_add_head include/linux/list.h:929 [inline]<br /> enqueue_timer+0x18/0xa4 kernel/time/timer.c:605<br /> mod_timer+0x14/0x20 kernel/time/timer.c:1161<br /> mrp_periodic_timer_arm net/802/mrp.c:614 [inline]<br /> mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627<br /> call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474<br /> expire_timers+0x98/0xc4 kernel/time/timer.c:1519<br /> <br /> To fix it, we can introduce a new active flags to make sure the timer will<br /> not restart.

*** Pendiente de traducción *** Mattermost versions 11.1.x

*** Pendiente de traducción *** Mattermost versions 11.1.x

*** Pendiente de traducción *** ADB(Android Debug Bridge) is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability.

*** Pendiente de traducción *** OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.

*** Pendiente de traducción *** The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.

*** Pendiente de traducción *** Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.

*** Pendiente de traducción *** Cross-site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.