Linux kernel vulnerabilities

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the kernel thread associated with queue 0, leading to a use-after-free when the backend is destroyed.

A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat is to confidentiality, integrity, and system availability. Versions before kernel 5.12-rc6 are affected.

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, leading to writing an arbitrary value.

The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled. This leads to writing an arbitrary value.

A use-after-free vulnerability in NFC sockets in the Linux kernel before 5.12.4 allows local attackers to elevate privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.

A flaw was found in the Linux kernel before version 5.12. The value of internal.ndata in the KVM API is mapped to an array index, which can be updated by a user process at any time, leading to an out-of-bounds write. The highest threat is to data integrity and system availability.

A race condition in the Linux kernel SCTP sockets implementation (net/sctp/socket.c) before version 5.12-rc8. If sctp_destroy_sock is called without the addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking. This can be exploited by an attacker with network service privileges to escalate to root or by an unprivileged user if a BPF_CGROUP_INET_SOCK_CREATE is attached that blocks creation of some SCTP sockets.

In the f2fs module of the Linux kernel (fs/f2fs/node.c) before version 5.12.0-rc4, there is an out-of-bounds (OOB) memory access flaw due to a bounds check failure. A local attacker can access out-of-bounds memory, leading to a system crash or leak of internal kernel information.

In the Linux kernel through 5.11.3, iSCSI data structures lack proper length constraints, allowing an unprivileged user to send a Netlink message up to the maximum length.

In the Linux kernel up to version 5.11.3, a vulnerability in the SCSI driver (drivers/scsi/scsi_transport_iscsi.c) allows an unprivileged user to craft Netlink messages, adversely affecting the system.

The raw MIDI kernel driver lacks protection against concurrent access, causing a double free in snd_rawmidi_input_params() and snd_rawmidi_output_status() within the snd_rawmidi_ioctl() handler in rawmidi.c. A local attacker could exploit this for privilege escalation.

Linux kernel before 2.3.18 or 2.2.13pre15 with SLIP and PPP options allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices.

Linux versions 2.1.132 and earlier allow local users to cause a denial of service (resource exhaustion) by reading a large buffer from a random device (e.g. /dev/urandom), which cannot be interrupted until the read has completed.