Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel regarding the improper classification of data as interlaced plain extents. This issue occurs when data is not properly aligned to the block size, potentially leading to out-of-bounds read errors.

A vulnerability related to null pointer dereference in the __udp_enqueue_schedule_skb() function has been fixed in the Linux kernel. This issue was reported by syzbot and may lead to failures in the UDP socket initialization functions.

A vulnerability in the Linux kernel related to bind attributes in sysfs for the reset device has been resolved. The issue allowed users to unbind the device, leading to a use-after-free error.

A vulnerability has been identified in the Linux kernel within the cachefiles_cull() function, leading to a loss of dentry references. Changes made in the cachefiles_bury_object() function did not account for all calls, resulting in improper reference management.

A vulnerability has been identified and resolved in the Linux kernel. The issue involves a double call to ida_free in the hv_pci_probe error path, leading to an attempt to free the same identifier twice.

A vulnerability has been identified in the Linux kernel related to improper initialization of the aio_cmd->iocb structure in target_core_file. This issue may lead to incorrect write failure statuses during write command execution.

A vulnerability has been identified in the Linux kernel regarding incorrect length accounting for TX packets that span multiple buffer descriptors. This issue leads to the loss of earlier bytes, potentially stalling the TX queue.

A vulnerability has been identified in the Linux kernel that allows the import of a zero-length buffer, leading to out-of-bounds memory reads. This issue occurs in the validate_fixed_range() function, where the lack of proper buffer length checking results in incorrect offset calculations.

A vulnerability in the Linux kernel related to the container_of operation in the intel_pmu_hw_config function has been fixed. The issue could lead to out-of-bounds memory reads when software events are present in a group of events.

A vulnerability has been identified in the Linux kernel that leads to a slab-out-of-bounds read in the io_bundle_nbufs() function. The issue arises from improper storage of length values, resulting in overflow and an infinite loop.

A vulnerability has been identified in the Linux kernel that allows out-of-bounds access to the odr_table array in the st_lsm6dsx_hwfifo_odr_store() function. This issue occurs when a user attempts to set the buffer sampling frequency for sensors other than the accelerometer or gyroscope.

A vulnerability has been identified in the Linux kernel related to a double free in the reset_add_gpio_aux_device() function on error. The issue occurs when __auxiliary_device_add() fails, leading to improper resource deallocation.

A vulnerability has been identified in the Linux kernel related to incorrect buffer size in DMA allocation and memcpy in zynqmp_nvmem. This flaw may lead to undersized DMA buffer access and potential memory corruption.

A vulnerability has been identified in the Linux kernel that occurs when switching to an alternate screen after resizing. The issue is that the old Unicode buffer is not properly discarded, leading to memory errors when restoring the screen state.

A vulnerability in the Linux kernel related to the unmap function was identified, which can unmap more than requested if the endpoint lands within the middle of a large or contiguous IOPTE. This issue has been resolved with a fix that ensures all unmapped areas are properly flushed.

A vulnerability has been identified in the Linux kernel's krb5enc function that allows bypassing integrity verification during asynchronous decryption. The issue is that upon completion of the skcipher operation, it signals 'done' without performing hash verification.

A vulnerability has been identified in the Linux kernel that leads to a double free when splitting a virtual memory area (VMA). The issue occurs when a user performs a partial munmap() on a privcmd mapping, allowing for improper memory pointer management.

A buffer overflow vulnerability has been identified in the Linux kernel in the file drivers/xen/sys-hypervisor.c. The issue arises because the build id returned by HYPERVISOR_xen_version(XENVER_build_id) is not NUL terminated, leading to memory overflow.

A vulnerability has been identified in the Linux kernel related to incorrect length checking of the response authenticator in the rxgk_verify_response() function. This flaw allows oversized authenticators to be accepted, potentially leading to system crashes.

A vulnerability has been identified in the Linux kernel related to the iptfs_clone_state() function. The issue is that x->mode_data is stored before the allocation of the reorder window, which may lead to pointing to freed memory in case of allocation failure.

A vulnerability has been identified in the Linux kernel related to memory access after a Function Level Reset (FLR). If the second FLR cannot allocate memory for the saved configuration, invalid memory access may occur.

A vulnerability in the Linux kernel has been fixed that caused all remaining subrequests from a read request to be abandoned during retry under certain circumstances. The abandonment process did not always have a valid value for the 'subreq' variable, which could lead to errors.

A vulnerability has been identified in the Linux kernel regarding incorrect pte restoration for lazyfree folios. The issue involved potentially setting an entire batch of anonymous folios as writable during unmapping, which has been fixed by respecting the writable bit during batching.

A vulnerability in the Linux kernel related to improper unwinding in the error path of the rocket_probe function has been resolved. The issue occurs when rocket_core_init() fails, potentially leading to out-of-bounds memory access.

A vulnerability has been identified in the Linux kernel that may lead to ubuf size overflow. This can result in undersized memory allocation and potential memory corruption.

A vulnerability in the Linux kernel related to task work flag manipulation in the context of io_uring has been resolved. The issue occurred during ring resizing, potentially leading to incorrect processing of the IORING_SQ_TASKRUN flag.

In the cpm_fwtp_msg_handler function in cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability has been identified in the Linux kernel related to the incorrect definition of the value for AMDGPU_DMUB_NOTIFICATION_MAX, potentially leading to out-of-bounds access in the array.

A vulnerability in the Linux kernel related to a KASAN bug was fixed, which occurred when writing data that was not 4-byte aligned to TX FIFO. This issue could be reproduced by writing 3 bytes of data to a NOR chip.

The check_stack_boundary function in the Linux kernel through version 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by mishandling invalid variable stack read operations.

The Linux kernel through version 4.14.8 contains a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact due to the lack of stack-pointer alignment enforcement.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by improperly using pointers instead of scalars.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service through integer overflow and memory corruption by leveraging unrestricted integer values for pointer arithmetic.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by mishandling register truncation.

The raw_sendmsg() function in the Linux kernel through version 4.14.6 has a race condition in inet->hdrincl, leading to uninitialized stack pointer usage. This allows a local user to execute code and gain privileges.

The Linux Kernel 2.6.32 and later are affected by a denial of service. Flooding the diagnostic port 0x80 can trigger an exception leading to a kernel panic.

The Linux kernel version 3.3-rc1 and later is affected by a vulnerability related to the processing of incoming L2CAP commands - ConfigRequest and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state.

The bnep_add_connection function in the Linux kernel before version 3.19 does not ensure that an l2cap socket is available, allowing local users to gain privileges via a crafted application.

The dccp_disconnect function in the Linux kernel through version 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.

Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in touch_pmd(), which may lead to overwriting read-only huge pages. Although not as severe as the original 'Dirty cow' vulnerability, it allows for overwriting pages like zero huge page.

The mm_init function in the Linux kernel before version 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.

The XFRM dump policy implementation in the Linux kernel before version 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

The sctp_do_peeloff function in the Linux kernel before version 4.14 does not check whether the intended netns is used in a peel-off action, which can lead to denial of service (use-after-free and system crash) or other unspecified impacts via crafted system calls.

In the Linux kernel before version 4.13.6, a vulnerability allows local users to gain privileges via crafted system calls. The issue arises from a race condition that leads to mishandling of packet_fanout data structures, resulting in a use-after-free error.

A vulnerability in the Linux kernel related to memory corruption that occurs when switching the path from UFO to non-UFO. The issue arises when UFO packet lengths exceed MTU, leading to negative values in calculations and writing out-of-bounds.

The Linux kernel has a heap out-of-bounds vulnerability in AF_PACKET sockets. This issue is analogous to the previously disclosed CVE-2016-8655, where a socket option changing socket state may race with safety checks.

The prepare_vmcs02 function in the Linux kernel up to version 4.13.3 does not ensure that the 'CR8-load exiting' and 'CR8-store exiting' controls exist when L1 omits the 'use TPR shadow' control, allowing KVM L2 guest OS users to gain read and write access to the hardware CR8 register.

The tpacket_rcv function in the Linux kernel before version 4.13 mishandles vnet headers, which might allow local users to cause a denial of service through buffer overflow and disk and memory corruption.