Linux kernel vulnerabilities

An out-of-bounds access in the RDMA rtrs-clt subsystem of the Linux kernel was found in init_conns(). In the cleanup loop after an error, the cid variable is set to con_num, leading to out-of-bounds access.

A vulnerability in the Linux kernel has been fixed in the nf_reject_ip6_tcphdr_put() function, which could send invalid data in reserved TCP bits. The use of skb_put_zero() allows for clearing the entire TCP header.

In the Linux kernel, the order of rate limiting for ICMP messages has been changed. Previously, the host-wide limit was checked first, then the per-destination limit; now the per-destination limit is checked first, and the host-wide limit is checked and consumed later. This change aims to prevent side-channel attacks.

In the Linux kernel, a vulnerability in the Smack module causes incorrect labeling of TCP/IPv4 return packets for incoming connections. The sender's label was mirrored instead of the receiver's label, leading to unauthorized write access.

A vulnerability related to the initialization of grc in the fou module has been fixed in the Linux kernel. If fou is NULL, there can be a condition where grc is used uninitialized.

In the SMB client in the Linux kernel, there is a double put of @cfile in smb2_rename_path(). If smb2_set_path_attr() is called with a valid @cfile and returns -EINVAL, the reference of @cfile was already dropped by a previous smb2_compound_op() call, leading to a double put.

In the Linux kernel, the mlx5e driver for SHAMPO has an incorrect page release issue. Under specific conditions (no skb, header_size == 0, last fragment of a header page), a SHAMPO header page is released incorrectly, leading to multiple releases of the same pages.

In the Linux kernel, in the nfsd module, there is a vulnerability where if nfsd4_encode_fattr4 does a "goto out" before checking for the security label, the args.context field remains uninitialized on the stack and is later freed. The fix initializes it early.

In the Linux kernel, the NFS server (nfsd) has a use-after-free (UAF) vulnerability in nfsd4_cb_getattr_release. After dropping the delegation reference, accessing its embedded fields is unsafe. The fix moves the release to the end.

In the Linux kernel, the inode_setsecctx hook for SELinux and Smack has a permission bypass. Root user on an NFS client can change security labels on files on an NFS filesystem exported with root squashing. The fix replaces __vfs_setxattr_noperm() with __vfs_setxattr_locked(), enforcing proper permission checks.

In the Linux kernel, in the nfsd module, there is a vulnerability in nfsd4_deleg_getattr_conflict that unsafely dereferences flc_owner without confirming that fl_lmops is the expected manager. The fix restores the behavior for the "!= &nfsd_lease_mng_ops" case as before the change, without any reference to a delegation.

In the Linux kernel's igb driver (Intel Gigabit Ethernet), there is an issue with large MAX_SKB_FRAGS values, causing payload corruption during transmission. The root cause is improper handling of shared info size when selecting ring layout, leading to attempts to fit two packets in one 4K page. The fix checks if 2K buffers are insufficient.

In the Linux kernel, there is a use-after-free vulnerability in the NVMe driver. The issue is that stopping the keep-alive mechanism was not moved into nvme_uninit_ctrl(), which can lead to keep-alive work being started and left pending after a controller start failure, and then to use-after-free when the host driver is unloaded.

A use-after-free in the ATM idt77252 driver of the Linux kernel was found in dequeue_rx(). After calling vcc->push(), the skb cannot be dereferenced because it has been freed.

A possible use-after-free in ip6_xmit() in the Linux kernel was found. If skb_expand_head() returns NULL, the skb and associated dst/idev may be freed, and further access can lead to a crash.

In the Linux kernel's net/mlx5e (SHAMPO), there is an issue with invalid WQ linked list unlink. When all strides in a WQE are consumed, the WQE is unlinked, but CQEs with 0 consumed strides for the same WQE can still arrive, causing a double unlink and list corruption. The fix accepts 0-sized consumed strides without unlinking again.

In the Linux kernel, the USB vhci-hcd driver has a reference handling issue. At several places the driver carries stale pointers to references that can still be used. The fix ensures new references are gained before dropping old ones, closing ZDI-CAN-22273.

In the Linux kernel, in the mlx5e driver, updating a CT entry can leak the modify header context. If allocation of a new modify header fails, the pointer to the old one is lost, and freeing an error pointer can cause a kernel panic.

In the Linux kernel, in the RDMA/iwcm subsystem, there is a use-after-free vulnerability related to destroying CM IDs. iw_conn_req_handler() associates a new rdma_id_private with an existing iw_cm_id, and rdma_destroy_id() frees both. The fix ensures that cm_work_handler() does not trigger use-after-free by waiting for all pending work to finish before freeing rdma_id_private.

In the Linux kernel's TIPC module, tipc_udp_addr2str() does not return a non-zero value on invalid UDP address, which can lead to buffer overflow in tipc_media_addr_printf(). The fix returns 1 on invalid address.

In the Linux kernel, a race condition was found in libceph between delayed_work() and ceph_monc_stop(). The handling of delayed work in ceph_monc_stop() is prone to races with mon_fault() and finish_hunting(), which can requeue the delayed work after it was canceled, potentially leading to use-after-free on the monc structure and associated objects.

In the Linux kernel, a use-after-free was found in the rswitch network driver in rswitch_poll(). The bug is that the skb pointer is freed before its len field is used to update interface statistics. The fix moves the instructions to use skb->len before freeing.

In the Linux kernel's ILA module, ila_output() does not block bottom halves (BH), which can lead to a race condition and corruption of dst_cache structures. The fix uses local_bh_disable().

A double free of special payload in the NVMe subsystem of the Linux kernel was found. If a discard request needs retry and the retry fails before a new payload is added, a double free occurs.

A use-after-free vulnerability was found in the Linux kernel's net/sched module related to resolving conntrack clashes. After a clash is resolved, the ct object may be freed but still passed to tcf_ct_flow_table_process_conn, leading to a read-after-free.

In the Linux kernel, the staging subsystem (gdm724x) has a use-after-free (UAF) vulnerability in gdm_lte_rx(). The netif_rx_ni() function frees the skb, and then the code tries to read skb->len, leading to access of freed memory.

In the Linux kernel, in NFSD, the handling of large file sizes in NFSv3 SETATTR/CREATE procedures was fixed by removing the min_t() check to avoid unexpected truncation.

In the Linux kernel, in NFSD, an underflow issue with ia_size was fixed. Since ia_size is a signed loff_t and NFS file size is unsigned, large values could cause underflow. A check was added in nfsd_setattr().

In the Linux kernel, a use-after-free vulnerability in the nvme driver during controller reset during load has been fixed. The issue occurs when the driver does not check controller readiness for AER submission, leading to a use-after-free condition observed with nvme-tcp.

In the Linux kernel, in the nvme-tcp driver, a possible use-after-free in transport error recovery work was fixed. The error recovery work must flush async_event_work before destroying the admin queue to prevent a race.

In the Linux kernel, a vulnerability in the nvme-rdma driver was fixed that could lead to a use-after-free in the transport error recovery work. The issue involved a race between checking the controller state and preparing the AER command, potentially causing incorrect behavior.

In the Linux kernel, in the ena network driver, validation for completion descriptors consistency has been added. It checks that the 'first' flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur, and a new reset reason for RX data corruption has been added.

In the Linux kernel, the TIPC module fixed an issue where a destination refcount was not forced before decryption. This could lead to a system crash in case of asynchronous cryptographic requests.

In the gve driver of the Linux kernel, a bug was found where napi->skb is left referencing a freed skb after dev_kfree_skb_any(). This can lead to a dangling pointer on subsequent napi_get_frags calls.

In the Linux kernel, the vmxnet3 driver has a vulnerability where after a failed memory allocation for the RX data ring, the desc_size field is not reset, causing the hypervisor to reference invalid memory during packet reception. This leads to a kernel panic (BUG) in skb_panic.

In the Linux kernel, a revert was made to a patch that allowed redirecting to any AF_XDP socket bound to the same umem. The patch introduced a potential kernel crash when multiple NAPI instances redirect to the same socket, corrupting the Rx ring state.

In the Linux kernel's SUNRPC module, gss_free_in_token_pages() has a loop termination condition issue because the in_token->pages[] array is not NULL terminated, leading to wild memory access (KASAN).

In the Linux kernel, the TIPC subsystem has an issue with size validation for received domain records. The tipc_mon_rcv() function does not verify that the number of members in a record does not exceed the MAX_MON_DOMAIN limit, which may lead to stack overflow. Additionally, an extra sanity check was added in tipc_link_proto_rcv() to prevent bit overflow.

In the Linux kernel, a vulnerability was found in the systemport driver due to missing global locking for the descriptor list shared across all transmit queues. Concurrent access from multiple queues can corrupt descriptors, leading to incorrect packet lengths and checksums in UDP and TCP traffic.

A potential use-after-free of glocks in the GFS2 filesystem of the Linux kernel was found during unmount. DLM automatically unlocks locks, but bast callbacks may remain active and access freed objects.

In the Linux kernel, the Open vSwitch (openvswitch) module has a vulnerability where the original conntrack tuple for ICMPv6 packets is overwritten during OVS_PACKET_CMD_EXECUTE processing. Parsing the ICMPv6 header zeroed out Neighbor Discovery (ND) fields even for non-ND packets, corrupting conntrack metadata and leading to incorrect packet matching.

A seg fault in rxe_comp_queue_pkt() in the RDMA rxe subsystem of the Linux kernel was found. An incoming response packet is enqueued and then dereferenced after deciding to run the completer task, which can lead to accessing freed memory.

In the Linux kernel, in the NFSD server, there is a crasher in nfsd4_encode_fattr4(). The issue is that args.acl is not initialized early, but it is used in an unconditional call to kfree() on the way out of the function, leading to a crash.

In the Linux kernel, a vulnerability in the vmbus driver was fixed where in CoCo VMs, a failed set_memory_encrypted() or set_memory_decrypted() call could lead to freeing decrypted (shared) memory pages. The fix leaks the pages in such cases to avoid potential functional or security issues.

In the Linux kernel, a vulnerability in the vmbus driver was fixed where in CoCo VMs, a failed set_memory_encrypted() or set_memory_decrypted() call could lead to freeing decrypted (shared) memory pages. The fix adds a field in struct vmbus_gpadl to track the decryption status of buffers, preventing such pages from being returned to the allocator.

In the Linux kernel, a problem was found in the hv_netvsc driver where decrypted memory could be freed. In CoCo VMs, an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, leaving memory shared. The netvsc driver could free decrypted/shared pages if set_memory_decrypted() fails. The fix checks the decrypted field in the gpadl to decide whether to free the memory.

In the Linux kernel, a problem was found in the vmbus driver (Drivers: hv) where ring buffers that couldn't be re-encrypted could be freed. In CoCo VMs, an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, leaving memory shared. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. The fix checks the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory.

A use-after-free (UAF) vulnerability was found in the Linux kernel in the tipc_buf_append() function in the error path of the TIPC protocol. The bug was reported by Sam Page working with Trend Micro Zero Day Initiative and may lead to memory corruption.

A vulnerability in the Linux kernel's TCP implementation allowed accepting ACK packets acknowledging bytes that were never sent. The issue was in ACK sequence validation per RFC 5961, enabling potential manipulation of data streams. The fix tightens ACK checks, rejecting packets with out-of-range acknowledgment numbers.

A vulnerability in the Linux kernel's TCP mechanism causes page frag corruption during page fault handling. The issue occurs when an HTTP server process (e.g., Apache) uses a mapped CIFS file, and a page fault triggers nested page frag allocation, leading to stream data corruption.