Linux kernel vulnerabilities

An issue was discovered in the Linux kernel before version 6.3.3 related to an out-of-bounds read in the crc16 function in lib/crc16.c when called from fs/ext4/super.c. The problem arises from improper offset checking in the ext4_group_desc_csum function.

Linux kernel 6.3 has a use-after-free vulnerability in the iopt_unmap_iova_range function in drivers/iommu/iommufd/io_pagetable.c.

The Linux kernel before version 6.2.9 has a race condition and resultant use-after-free in emac.c if a physically proximate attacker unplugs an emac based device.

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() before detaching from their group, leading to a dangling pointer.

The Linux kernel's udmabuf device driver contains a vulnerability due to lack of proper validation of user-supplied data in a fault handler, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

A use-after-free vulnerability in the Linux kernel traffic control index filter (tcindex) allows local privilege escalation. The tcindex_delete function does not properly deactivate filters in case of perfect hashes, leading to double freeing. A local attacker can escalate privileges to root.

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.

The Linux kernel has a use-after-free vulnerability in io_uring during the IORING_OP_SPLICE operation. Missing the IO_WQ_WORK_FILES flag means the operation does not increase the reference counter of current->nsproxy, which can lead to invalid decrement and subsequent use-after-free.

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. Recommended upgrade to Kernel 6.2 or apply relevant stable backports.

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.

In the Linux kernel, a vulnerability was identified in the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c, in the Ethernet Handler component. Manipulation leads to a use-after-free. A patch is available, but no released kernel version was ever affected by this CVE.

A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated with this attack. The exploitability is said to be difficult.

In the Linux kernel up to versions 5.10.162/5.15.85/6.0.15/6.1.1, a vulnerability was found in the libbpf component, in the btf_dump_name_dups function of tools/lib/bpf/btf_dump.c. Manipulation leads to a use-after-free. The issue is fixed in versions 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2.

A vulnerability in the inode_init_owner() function logic in the Linux kernel (fs/inode.c) allows local users to create files on XFS filesystems with unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a group not containing the user. This can lead to excessive permissions.

An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

A use-after-free in the Linux kernel's tc_new_tfilter can allow a local attacker to escalate privileges. It requires unprivileged user namespaces.

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

A NULL pointer dereference flaw in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux kernel, requiring CAP_SYS_ADMIN, allows a local attacker to crash the system or leak kernel internal information. The highest threat is to system availability.

In the Linux kernel's NFC driver st21nfca (drivers/nfc/st21nfca/se.c), the function st21nfca_connectivity_event_received has buffer overflows in EVT_TRANSACTION due to untrusted length parameters. The vulnerability affects versions up to 5.16.12.

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

An issue was discovered in aspeed_lpc_ctrl_mmap in the Linux kernel before 5.14.6. Local attackers with access to the Aspeed LPC control interface could overwrite kernel memory and potentially execute privileges. This occurs because a certain comparison uses values that are not memory sizes.

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the kernel thread associated with queue 0, leading to a use-after-free when the backend is destroyed.

A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat is to confidentiality, integrity, and system availability. Versions before kernel 5.12-rc6 are affected.

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, leading to writing an arbitrary value.

The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled. This leads to writing an arbitrary value.

A use-after-free vulnerability in NFC sockets in the Linux kernel before 5.12.4 allows local attackers to elevate privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.

A flaw was found in the Linux kernel before version 5.12. The value of internal.ndata in the KVM API is mapped to an array index, which can be updated by a user process at any time, leading to an out-of-bounds write. The highest threat is to data integrity and system availability.

A race condition in the Linux kernel SCTP sockets implementation (net/sctp/socket.c) before version 5.12-rc8. If sctp_destroy_sock is called without the addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking. This can be exploited by an attacker with network service privileges to escalate to root or by an unprivileged user if a BPF_CGROUP_INET_SOCK_CREATE is attached that blocks creation of some SCTP sockets.

In the f2fs module of the Linux kernel (fs/f2fs/node.c) before version 5.12.0-rc4, there is an out-of-bounds (OOB) memory access flaw due to a bounds check failure. A local attacker can access out-of-bounds memory, leading to a system crash or leak of internal kernel information.

In the Linux kernel through 5.11.3, iSCSI data structures lack proper length constraints, allowing an unprivileged user to send a Netlink message up to the maximum length.

In the Linux kernel up to version 5.11.3, a vulnerability in the SCSI driver (drivers/scsi/scsi_transport_iscsi.c) allows an unprivileged user to craft Netlink messages, adversely affecting the system.

The raw MIDI kernel driver lacks protection against concurrent access, causing a double free in snd_rawmidi_input_params() and snd_rawmidi_output_status() within the snd_rawmidi_ioctl() handler in rawmidi.c. A local attacker could exploit this for privilege escalation.

Linux kernel before 2.3.18 or 2.2.13pre15 with SLIP and PPP options allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices.

Linux versions 2.1.132 and earlier allow local users to cause a denial of service (resource exhaustion) by reading a large buffer from a random device (e.g. /dev/urandom), which cannot be interrupted until the read has completed.