Linux kernel vulnerabilities

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization.

The __skb_flow_dissect function in the Linux kernel before version 4.3 does not ensure initialization of n_proto, ip_proto, and thoff, allowing remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.

The ip6gre_err function in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, leading to out-of-bounds access.

A use-after-free vulnerability in the kvm_ioctl_create_device function in the Linux kernel before version 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.

The sctp_sf_ootb function in the Linux kernel before version 4.8.8 lacks chunk-length checking for the first chunk, allowing remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.

A use-after-free vulnerability in the __sys_recvmmsg function in the Linux kernel before version 4.5.2 allows remote attackers to execute arbitrary code via mishandled error processing during a recvmmsg system call.

The usbip_recv_xbuff function in the Linux kernel before version 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.

The nf_nat_redirect_ipv4 function in the Linux kernel before version 4.4 allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to system crashes. This issue is related to CVE-2003-1604.

CVE-1999-0804 vulnerability affects Linux 2.2.x kernels, where malformed ICMP packets with unusual types, codes, and IP header lengths can lead to denial of service.

Linux kernel versions 2.2.3 and earlier allow a remote attacker to perform an IP fragmentation attack, leading to a denial of service.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism related to BIG TCP packet aggregation has been found. Improper validation of aggregation criteria allows an out-of-bounds write and wrapping of the mac_header pointer, potentially leading to system crashes or code execution. The issue affects older stable branches, e.g., 6.18.y, and has been fixed by tightening conditions in skb_gro_receive().

In the Linux kernel, a vulnerability in ptp: vmclock was fixed that allowed read-only mappings to become writable. The vmclock_miscdev_mmap() function rejected writable mappings of the shared vmclock ABI page with -EROFS, but left VM_MAYWRITE set. Userspace could map the page read-only and then upgrade it to writable with mprotect(), allowing the guest to corrupt host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. The fix clears VM_MAYWRITE on the read-only path so the mapping cannot be upgraded.

In the Linux kernel, a vulnerability in of: reserved_mem was fixed that caused an out-of-bounds write when too many dynamic regions are defined. On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, the function writes past the end of the local array. The fix adds a bounds check that logs an error and skips the excess regions, restoring the original behavior.

In the Linux kernel, a vulnerability in wifi: mac80211 was fixed regarding validation of individual TWT parameters before driver setup. ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. The fix does not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.

In the Linux kernel, a vulnerability in Bluetooth: ISO was fixed regarding dangling hcon references in iso_conn. After iso_conn_del(), ISO sockets should not dereference the hcon anymore. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. The fix simplifies this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

In the Linux kernel, a vulnerability in iomap was fixed that caused a deadlock. iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. The fix adds a separate bio_set to avoid this deadlock. Additionally, iomap_ioend_split_bioset is marked static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.

A vulnerability in the Linux kernel's MGLRU (Multi-Gen LRU) mechanism causes stale batch updates after memcg reparenting. A race between the page table walker and the memcg reparenting path can lead to underestimated nr_pages, potentially causing premature OOM.

In the Linux kernel, a vulnerability in mm/percpu-km was fixed that caused bitmap overflow and accounting issues in pcpu_create_chunk(). In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed, when nr_units > 1, the function writes beyond chunk->populated. The fix uses chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. The issue was introduced by commit a63d4ac4ab609, and later commit b539b87fed37f added pcpu_nr_empty_pop_pages and caused the accounting issue.

In the Linux kernel, the SCTP Adaptation Indication parameter length was not properly validated. A header-only parameter was accepted, leading to an out-of-bounds read and potential disclosure of four receive-buffer tail bytes.

In the Linux kernel's ALSA PCM subsystem, there is an issue with waking linked drain waiters on unlink. This can lead to use-after-free of a stack frame during a later wake-up.

In the Linux kernel's igc driver, there is an issue with napi_synchronize() in igc_down() that can cause the network interface to hang during shutdown when AF_XDP zero-copy is used.

In the Linux kernel's io_uring, there is an issue with preserving per-task restrictions across exec. These restrictions are dropped during task context cleanup, allowing an unrestricted ring to be created after exec.

A vulnerability in the Linux kernel's SPI-NAND driver for Qualcomm chips (spi-qpic-snand) was found. The SET_FEATURE value was written to the register after command execution, causing a one-operation delay. As a result, the chip remained in OTP mode, making the flash memory unusable and the device unbootable.

In the Linux kernel's max17040 driver, there is an issue with handling a missing status supplier. When no supplier is registered, the function returns success but the status value remains uninitialized, potentially leading to reading invalid data by userspace.

In the Linux kernel's dasd driver, there is an issue with an undersized format-check buffer. The fmt_buffer_size variable is declared as int, causing truncation of the computed size and potentially leading to out-of-bounds write.

In the Linux kernel's zcrypt driver, there is an issue with incorrect domain value verification for EP11 CPRBs. The wrong upper limit can lead to heap memory access beyond perms->adm when an administrative CPRB is sent.

In the Linux kernel's zcrypt driver, there is an issue with missing memory scrub at clear key import in cca_clr2cipherkey(). The internal buffer may contain sensitive data that could be exposed via memory reuse.

In the Linux kernel, the CAN J1939 function j1939_session_fresh_new() did not zero the buffer before use, potentially leaving residual data. The fix zeroes the allocated buffer to prevent potential information leakage.

In the Linux kernel, the CAN softing driver's fw_parse() function did not validate that firmware records fit within the firmware image, potentially leading to out-of-bounds reads. Additionally, bounds calculations for DPRAM writes were prone to integer overflow, and the application loader's data copy was not properly bounded.

In the Linux kernel, the AMD Display driver (drm/amd/display) lacked a check for successful allocation of the phantom plane in dml21_add_phantom_plane(), which could lead to a segmentation fault later.

In the Linux kernel, the AMD Display driver (drm/amd/display) function get_ss_info_from_atombios() used an uninitialized context for logging, leading to NULL pointer dereference during DC_LOG_SYNC() calls. Similar issues exist in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers(). The fix changes the logging context to use the one from the clock source base.

In the Linux kernel, the AMD KFD driver (drm/amdkfd) lacked authorization checks in KFD_IOC_DBG_TRAP_DISABLE, allowing users with /dev/kfd access to terminate another process's debug session without proper ownership or ptrace authorization.

In the Linux kernel, the VMware driver (drm/vmwgfx) had two sites in vmwgfx_resource.c that assigned boolean literals to the guest_memory_size field, which is an allocation-size field, instead of the adjacent guest_memory_dirty bitfield. This caused guest_memory_size to hold 0 or 1 instead of the actual allocation size, leading to errors in dirty page range calculations and buffer allocation.

In the Linux kernel's DRM vmwgfx driver, a vulnerability exists due to missing cursor size validation for the MOB path (SVGA_CAP2_CURSOR_MOB). An attacker with DRM master privileges can use DRM_IOCTL_MODE_CURSOR2 to set an oversized cursor, leading to a call to vmw_bo_map_and_cache(NULL) and a kernel oops.

In the Linux kernel, the VMware driver (drm/vmwgfx) function vmw_external_bo_copy() did not validate bounds for copy operations on imported dma-buf buffers. Lack of validation could lead to out-of-bounds reads or writes, especially with crafted plane state data.

In the Linux kernel, KVM for ARM64 (vgic) had an issue of double-deactivation of interrupts in the nested context. The physical interrupt was already deactivated via the HW bit in the LR, and the extra deactivation could trigger an errata on AmpereOne processors, causing loss of pending interrupt state and blocking future interrupts.

In the Linux kernel, the DMA Engine driver (idxd) had a double-free issue for wq, engine, and group structures. The release callbacks called kfree() on the enclosing struct, and additionally error paths and cleanup functions also called kfree() after put_device(), leading to double free.

In the Linux kernel, the EROFS filesystem had a bug where backing files for page cache sharing had an invalid f_path (left as NULL). This caused a kernel NULL pointer dereference during mincore, crashing the system in the erofs/028 test.

In the Linux kernel, the hwmon ltc4282 driver had a missing return statement when reading the minimum alarm voltage for the VGPIO channel, causing an out-of-bounds access.

In the Linux kernel, the hwmon sht3x driver had unaligned memory accesses when reading 16-bit temperature and humidity values. Using be16_to_cpup() on odd offsets causes alignment faults on strict-alignment architectures (e.g., ARMv5, SPARC), leading to kernel panic.

In the Linux kernel, the Bluetooth subsystem (hci_sync) had a theoretical use-after-free (UAF) vulnerability in hci_connect_acl/le_sync() callbacks. If the connection (conn) is freed while the hci_sync task is running, it could lead to use of freed memory.

In the Linux kernel, the SCSI target iblock driver had a bug in iblock_execute_pr_out() where the NULL check for PREEMPT, PREEMPT_AND_ABORT, and RELEASE operations was incorrect. This allows unimplemented hooks (ops->pr_clear) to be called, leading to NULL pointer dereference.

In the Linux kernel, the SCSI UFS core driver had a bug where the hba->rpmbs list was not initialized in ufshcd_alloc_host(). If ufs_rpmb_probe() fails, a NULL pointer dereference could occur during device teardown.

In the Linux kernel, the tracing/mmiotrace subsystem lacked a NULL check for mmio_trace_array in __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are called while mmio_trace_array is NULL (e.g., before initialization or after disabled), accessing tr->array_buffer.buffer results in a NULL pointer dereference crash.

In the Linux kernel for RISC-V, the function vec_check_unaligned_access_speed_all_cpus was marked as __init, placing its code in the .init.text section which is freed after boot. This function runs in a kernel thread that may not finish before the memory is freed, leading to a page fault when trying to execute code from the freed region.

In the Linux kernel's iommufd/viommu subsystem, in iommufd_vdevice_alloc_ioctl(), after a failed vdevice_size validation, jumping to out_put_idev skips releasing the igroup lock, causing a deadlock for subsequent vDEVICE operations on that group.

In the Linux kernel's migrate_vma_collect_pmd(), pte_pfn() and pte_dirty() may be called on non-present PTEs (e.g., device-private entries), leading to potential crashes or incorrect dirty folio accounting. The fix adds pte_present() checks.

In the Linux kernel's snapshot_page(), __page_2 is read for order-1 folios, but it should only be read when nr_pages > 2. This can cause a page fault during DLPAR memory removal on ppc64le systems.

In the Linux kernel for RISC-V, a bug was found in the calculation of vmemmap_start_pfn alignment. The issue uses alignment expressed in bytes of struct page storage instead of physical address bytes, causing a warning and potential memory initialization problems on systems like QEMU virt.