Linux kernel vulnerabilities

In the Linux kernel, a vulnerability in the SMC network module was found where smc_lgr_cleanup_early() incorrectly deleted the list head instead of the actual link group. This could lead to memory corruption and a kernel panic.

In the Linux kernel, a use-after-free vulnerability in the NFS server (nfsd) due to a delegation race has been fixed. A delegation break can arrive as soon as vfs_setlease is called, leading to the delegation being added to del_recall_lru and then freed without being removed, manifesting later as use-after-free or list corruption.

In the Linux kernel's net/tls module, a flipped sign in tls_err_abort() calls leads to incorrect error handling and potential memory corruption. The fix ensures consistent negative error codes and centralizes the sign flip.

In the Linux kernel, the isofs module has an out-of-bounds access when reading a corrupted ISO image. The fix adds a sanity check on the directory entry length before using it.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab out of bounds write in smb_inherit_dacl(). slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size.

In the Linux kernel, a use-after-free vulnerability was found in the CIFS module in the rdata->read_into_pages() function. Under unstable network conditions, reading data from the server can lead to use of freed memory (rdata pointer), causing a system crash or potential code execution.

In the Linux kernel, the ceph module has a vulnerability where the kclient is blocklisted after receiving a corrupted snap trace. The issue can lead to continuing I/O and metadata access, potentially corrupting data.

In the Linux kernel's scsi iscsi module, a use-after-free bug exists in task abort handling. The fix reverts a goto to common cleanup code and moves iscsi_get_conn() after checking task validity.

In the Linux kernel, a use-after-free vulnerability in the iSCSI driver (scsi: iscsi) during resets has been fixed. The issue occurs when iscsi_conn_teardown wakes up the EH thread and frees the connection while those threads are still accessing the connection's ehwait field. The fix moves the TMF fields from the connection to the session.

In the Linux kernel, the CAN J1939 subsystem has a Use-after-Free vulnerability. The issue is that a skb is taken from the session queue without incrementing the ref count, which can lead to use-after-free if the skb is concurrently taken from the queue due to a CTS.

A vulnerability has been identified in the Linux kernel regarding the improper linking of new fs rules into the tree. This issue can lead to a situation where a rule with a refcount of 2 is not properly linked, resulting in a system crash when the flow group is deleted.

In the Linux kernel, the dma-direct function has a page leak issue when dma_set_decrypted() fails. In TDX environments, an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, returning shared memory to the page allocator. The fix leaks the pages in such cases instead of freeing them.

In the Linux kernel, a use-after-free vulnerability in the SMB client was fixed, affecting DFS referral handling, mounting, and DFS failover. The fix ensures all children from the parent session are properly refcounted and removes the unnecessary dfs_ses_list.

In the Linux kernel, in the SMB client, there is a potential use-after-free vulnerability in smb2_is_valid_lease_break(). The issue involves sessions that are being torn down (status == SES_EXITING), which can lead to use-after-free. The fix skips such sessions to avoid UAF.

In the Linux kernel, the crypto/safexcel subsystem lacks error handling for dma_map_sg() calls. The dma_map_sg() macro may return 0 on error. The fix adds checks in case of macro failure and ensures unmapping of previously mapped buffers with dma_unmap_sg().

In the Linux kernel, the nvmet module has a use-after-free vulnerability that can be triggered by blktests nvme/004. The issue leads to reading freed memory during request completion, potentially causing a system crash.

In the Linux kernel, the nvme-tcp module has a use-after-free vulnerability when detecting digest errors. The fix requires breaking out of the io_work loop after setting rd_enabled to true, to avoid reading data from an out-of-sync or corrupted TCP stream.

In the Linux kernel, the SUNRPC module fixed memory leaks in gssx_dec_option_array. Previously, error-handling paths did not free memory allocated for credentials and option array data.

A use-after-free vulnerability was found in the Linux kernel's SCSI core subsystem. The issue occurs when .exit_cmd_priv implementations are called after resources associated with the SCSI host have been freed, leading to access to freed memory. The fix ensures scsi_remove_host() waits for the tag set to be freed before invoking these functions.

In the Linux kernel, the Xilinx cryptographic driver (zynqmp) has an issue where crypto_finalize_request is called without disabling bottom halves (BH), leading to a WARNING and potential system instability.

In the Linux kernel's cifs module, an underflow in parse_server_interfaces() occurs due to comparing ssize_t with size_t, causing the loop to continue with negative bytes_left. The fix addresses the type conversion issue.

In the Linux kernel, the mlx5e driver (for Mellanox network cards) has a bug in the TLS RX resync flow, causing a crash. The list of TLS contexts is vulnerable to corruption due to lack of protection of entries against movements from resync_handle_seq_match() until their resync handling in napi is fully completed.

In the Linux kernel's ksmbd module, there is a lack of validation of IPC response payload size, which can lead to memory overrun or slab-out-of-bounds. The fix adds validation for three IPC responses with payload.

Use-after-free vulnerability in the Linux kernel's TLS implementation during failed backlog decryption. When the crypto operation returns -EBUSY, tls_do_decryption waits for all async decryptions to complete, and if one fails, pages are released but have already been passed to the async callback.

In the Linux kernel, in the SCSI target subsystem (pscsi), there is a bug in handling the error case when freeing a bio object. A bio allocated by bio_kmalloc() must be freed by bio_uninit() and kfree(), but this is not done correctly in this case, leading to a WARN and NULL pointer dereference in bio_free().

In the Linux kernel, in tunnel functions (e.g., VXLAN), there is an out-of-bounds read when building IPv6 PMTU errors. The issue occurs when the ICMPv6 error is built from a non-linear skb, leading to memory corruption (KASAN: slab-out-of-bounds).

In the Linux kernel, the filelayout_decode_layout() function in NFS used an incorrect structure size, potentially leading to memory corruption. The fix changes the size to NFS_MAXFHSIZE, which matches the buffer size.

In the Linux kernel TIPC module, a vulnerability was found where improperly appending fragments to a skb's frag_list can lead to use-after-free. The issue occurs when the skb was cloned or modified by pskb_copy() or pskb_may_pull(), and the new fragment is shared by multiple skbs despite only one skb_get() call.

In the Linux kernel, the lantiq network driver has a vulnerability leading to memory corruption in the RX ring. When memory allocation or DMA mapping fails, an invalid address is programmed into the descriptor, which can lead to memory corruption. The fix makes DMA reuse the previous skb and mapping and drop the packet, incrementing the rx drop counter.

A vulnerability related to buffer overflow in the READDIR function has been identified in the Linux kernel. The issue occurs when a client sends a count argument that is too small, leading to incorrect buffer size calculations and allowing writes beyond its boundaries.

The vulnerability in the Linux kernel concerns incorrect management of the sk_rx_dst field in TCP socket structures, which did not follow standard RCU rules. This can lead to use-after-free in early demux functions, as reported by syzbot.

In the Linux kernel, the RDMA/srp subsystem has an issue where srp_abort() calls scsi_done(), which can lead to use-after-free. The fix removes this call, keeping the srp_free_req() call before returning SUCCESS.

In the Linux kernel, a race condition between session lookup and expiration in ksmbd can lead to a use-after-free. The fix adds an rwsem to synchronize these operations.

In the Linux kernel, the UDP module has a vulnerability where L4 aggregation is incorrectly applied to UDP tunnel packets. When GRO options are enabled, it can corrupt inner protocols, e.g., ignoring different VXLAN IDs.

In the Linux kernel, a use-after-free vulnerability in the emac_mac_tx_buf_send function of the EMAC network driver has been fixed. The issue is that after the skb is freed in case of an error in emac_tx_fill_tpd(), the skb is still used via skb->len by netdev_sent_queue(), leading to a use-after-free.

A vulnerability in the Linux kernel's SCTP protocol leads to a use-after-free of a transport structure. The issue occurs when processing a duplicate COOKIE-ECHO chunk in sctp_sf_do_dupcook_a(), where COOKIE-ACK and SHUTDOWN chunks are allocated with the new association but later used by the old one, potentially causing a system panic.

In the Linux kernel, the ch_ktls module has an issue causing kernel panic. Taking page refcount is not ideal and can lead to panic; it's better to take tx_ctx lock for the complete skb transmit to avoid page cleanup during transmission.

In the Linux kernel, the netlabel module has two out-of-bounds array accesses: one in cipso_v4_map_lvl_valid() and the other in netlbl_bitmap_walk(). The fixes are straightforward and involve bounds checking.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup. If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid.

In the Linux kernel, a use-after-free vulnerability in the ksmbd_tcp_new_connection() function of the ksmbd module has been fixed. The issue is caused by a race between handling a new TCP connection and its disconnection, leading to a use-after-free on the tcp_transport structure.

In the Linux kernel, in the tls module, there is a vulnerability due to a race between tx work scheduling and socket close. The submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). The fix reorders scheduling the work before calling complete().

In the Linux kernel, a TLS module issue was fixed regarding the handling of crypto requests that may be backlogged. When the CRYPTO_TFM_REQ_MAY_BACKLOG flag is set, crypto_aead functions can return -EBUSY instead of -EINPROGRESS, causing the async callback to be invoked twice. The fix converts -EBUSY to -EINPROGRESS to avoid modifying error handling paths.

In the Linux kernel, there is a race condition in the TLS implementation between async notify and socket close. The submitting thread may exit as soon as the async crypto handler calls complete(), risking access to already freed data.

Use-after-free vulnerability in the Linux kernel's TLS implementation with partial reads and async decrypt. tls_decrypt_sg does not take a reference on pages from clear_skb, so put_page() in tls_decrypt_done releases them, leading to use-after-free in process_rx_list.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request. smb2_get_msg() in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if SMB2_TREE_CONNECT_HE is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.

In the Linux kernel, the ksmbd module has an out-of-bounds access in init_smb2_rsp_hdr(). If a client sends an SMB2 negotiate request and then an SMB1 negotiate request, the function is called for the SMB1 request, leading to an issue. The fix ignores SMB1 packets after need_neg is set to false.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob(). If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

An issue was discovered in the Linux kernel before version 6.3.4 related to an out-of-bounds read in smb2_find_context_vals. This occurs when the name_len of create_context is larger than the tag length.