Linux kernel vulnerabilities

A use-after-free flaw was found in the memory management subsystem in the Linux Kernel, located in mm/mempolicy.c. This issue is caused by a race between mbind() and VMA-locked page fault, which may allow a local attacker to crash the system or lead to a kernel information leak.

A memory leak flaw was found in nft_set_catchall_flush in the Linux Kernel, which may allow a local attacker to cause double-deactivations of catchall elements, resulting in a memory leak.

A Use After Free vulnerability was found in the Fedora Linux kernel 5.9.0-rc9 in the vgacon_invert_region() function. It allows attackers to obtain sensitive information from kernel memory.

An issue was discovered in l2cap_sock_release in the Linux kernel before version 6.4.10, leading to a use-after-free due to mishandling of children of an sk.

This CVE was rejected because the description attributes a vulnerability to a non-existent Linux kernel function (usb_giveback_urb()) and the reported issue cannot be mapped to any valid codebase.

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

A flaw in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory allows unauthorized memory access. Despite the 'Randomize per-cpu entry area' feature implemented in /arch/x86/mm/cpu_entry_area.c (based on CVE-2023-0597), there is still a risk of per-cpu entry area leaks. A local user may guess the location of exception stacks or other important data, potentially leading to privilege escalation.

A use-after-free flaw was found in vcs_read in vc_screen.c in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

A flaw was found in the skcipher_recvmsg function in the Linux kernel’s interface for symmetric key cipher algorithms. This flaw allows a local user to crash the system.

A vulnerability exists in the memory management subsystem of the Linux kernel, related to incorrect lock handling for accessing virtual memory areas. This can lead to use-after-free issues, allowing arbitrary kernel code execution and privilege escalation.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. A local attacker with user access can escalate privileges.

A NULL pointer dereference flaw exists in the Linux kernel's submit_lookup_cmds function due to a lack of check on the return value of kmalloc(). This issue allows a local user to crash the system.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the rkvdec_remove function in rkvdec.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the renesas_usb3_remove function in renesas_usb3.c.

An issue was discovered in the Linux kernel through 6.3.8 related to a use-after-free in the ravb_remove function in ravb_main.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the cedrus_remove function in cedrus.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the dm1105_remove function in dm1105.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the saa7134_finidev function in saa7134-core.c.

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c. This flaw could allow a local attacker to crash the system or leak kernel internal information.

An issue was discovered in the Linux kernel before version 6.3.3 related to an out-of-bounds read in the crc16 function in lib/crc16.c when called from fs/ext4/super.c. The problem arises from improper offset checking in the ext4_group_desc_csum function.

Linux kernel 6.3 has a use-after-free vulnerability in the iopt_unmap_iova_range function in drivers/iommu/iommufd/io_pagetable.c.

The Linux kernel before version 6.2.9 has a race condition and resultant use-after-free in emac.c if a physically proximate attacker unplugs an emac based device.

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() before detaching from their group, leading to a dangling pointer.

The Linux kernel's udmabuf device driver contains a vulnerability due to lack of proper validation of user-supplied data in a fault handler, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

A use-after-free vulnerability in the Linux kernel traffic control index filter (tcindex) allows local privilege escalation. The tcindex_delete function does not properly deactivate filters in case of perfect hashes, leading to double freeing. A local attacker can escalate privileges to root.

A use-after-free flaw was found in btsdio_remove in drivers/bluetooth/btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem leading to a UAF on hdev devices.

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.

The Linux kernel has a use-after-free vulnerability in io_uring during the IORING_OP_SPLICE operation. Missing the IO_WQ_WORK_FILES flag means the operation does not increase the reference counter of current->nsproxy, which can lead to invalid decrement and subsequent use-after-free.

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. Recommended upgrade to Kernel 6.2 or apply relevant stable backports.

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.

In the Linux kernel, a vulnerability was identified in the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c, in the Ethernet Handler component. Manipulation leads to a use-after-free. A patch is available, but no released kernel version was ever affected by this CVE.

A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated with this attack. The exploitability is said to be difficult.

In the Linux kernel up to versions 5.10.162/5.15.85/6.0.15/6.1.1, a vulnerability was found in the libbpf component, in the btf_dump_name_dups function of tools/lib/bpf/btf_dump.c. Manipulation leads to a use-after-free. The issue is fixed in versions 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2.

A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.

A vulnerability in the inode_init_owner() function logic in the Linux kernel (fs/inode.c) allows local users to create files on XFS filesystems with unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a group not containing the user. This can lead to excessive permissions.

An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

A use-after-free in the Linux kernel's tc_new_tfilter can allow a local attacker to escalate privileges. It requires unprivileged user namespaces.

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

A NULL pointer dereference flaw in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux kernel, requiring CAP_SYS_ADMIN, allows a local attacker to crash the system or leak kernel internal information. The highest threat is to system availability.

In the Linux kernel's NFC driver st21nfca (drivers/nfc/st21nfca/se.c), the function st21nfca_connectivity_event_received has buffer overflows in EVT_TRANSACTION due to untrusted length parameters. The vulnerability affects versions up to 5.16.12.

drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

An issue was discovered in aspeed_lpc_ctrl_mmap in the Linux kernel before 5.14.6. Local attackers with access to the Aspeed LPC control interface could overwrite kernel memory and potentially execute privileges. This occurs because a certain comparison uses values that are not memory sizes.

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.