Linux kernel vulnerabilities

A vulnerability in the Linux kernel's NTFS filesystem was found where ntfs_attr_find() and ntfs_external_attr_find() do not properly validate length fields in variable-length resident attributes. A crafted disk image can trigger an out-of-bounds read (slab-out-of-bounds) during filename lookup operations.

In the Linux kernel, a bounds check was added before accessing EA entries in the NTFS filesystem. In ntfs_ea_lookup and ntfs_listxattr, it verifies that there is enough space in the EA entry before accessing the next_entry_offset field.

In the Linux kernel, the NTFS filesystem no longer converts zero-length $DATA attributes to non-resident. Previously, when a resident attribute could not be grown in place, other resident attributes were converted to non-resident, but now zero-length $DATA attributes are skipped because fsck treats such non-resident attributes as corruption.

In the Linux kernel, the NTFS filesystem now performs stricter validation of the index block header. The ntfs_index_block_inconsisent() function was modified to validate INDEX_HEADER geometry in INDX blocks more thoroughly, and ntfs_lookup_inode_by_name() uses this function to validate INDX blocks.

In the Linux kernel, the NTFS filesystem now validates index entries on reading. Index entries are validated immediately after reading an index root or index block from disk, eliminating repeated checks in lookup and readdir and reducing the risk of missing checks in those paths.

In the Linux kernel, the NTFS filesystem detects mapping-pairs LCN accumulator overflow. The parser accumulates relative LCN deltas in a signed integer, and a corrupted attribute can drive the addition past the representable range. An overflow check is added before storing the next run.

In the Linux kernel, the NTFS filesystem now validates resident $INDEX_ROOT values on lookup. Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Validation of the header fields is added before returning the attribute, requiring 8-byte alignment, a sane entries_offset, index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header.

In the Linux kernel's NTFS3 filesystem, the indx_find_buffer function had no recursion depth limit, potentially leading to kernel stack overflow. The fix adds a depth parameter and a check against the limit.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows an out-of-bounds write when promoting a full resident $INDEX_ROOT to $INDEX_ALLOCATION. A crafted NTFS image can cause memcpy of attacker-controlled data past the allocated buffer, leading to heap corruption.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows out-of-bounds write due to missing validation of the split-point offset in indx_insert_into_buffer. A crafted NTFS image causes an integer underflow and a near-4GiB memmove, corrupting memory and panicking the kernel.

In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.

In the Linux kernel's NTFS filesystem, system files such as $Bitmap can be written from userspace, leading to volume corruption and writeback deadlock. The fix marks base metadata files as immutable during inode read so the VFS rejects write, mmap, truncate, and unlink with -EPERM.

In the Linux kernel's NTFS filesystem, ntfs_map_runlist_nolock() can encounter a resident attribute where a non-resident one is expected, previously triggering only a WARN_ON and leading to reading the wrong union member. The fix replaces the WARN_ON with an -EIO error return, causing crafted images to be rejected during mount.

A vulnerability was found in the Linux kernel's tcp_connect() function related to TCP and MD5 authentication. In one code branch, the tcp_md5sig_info structure and tcp_md5sig_key entries are freed without respecting the RCU grace period, causing a race condition with softirq readers. This leads to a use-after-free of MD5 key memory.

In the Linux kernel, the xfrm module has a double-free issue in nat_keepalive_send(). When the IPv4 or IPv6 helper reports an error, the keepalive packet is freed, but if the packet has already been handed to the network stack, it may be freed again, leading to unsafe operation.

In the Linux kernel, the nvmet-auth module has a heap out-of-bounds write vulnerability in nvmet_execute_auth_receive(). The function trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In SUCCESS1 and FAILURE1 states, a short buffer can lead to writing past the allocated memory.

In the Linux kernel, the nvmet-rdma module has an issue with handling inline data with a nonzero offset. The function nvmet_rdma_use_inline_sg() maps the host-controlled offset but assumes the data begins in the first inline page. For offsets larger than the page size, a length underflow can occur, leading to out-of-bounds reads.

In the Linux kernel, the dm-verity module has a buffer overflow in FEC calculation. The bug allows writing beyond the bounds of the lambda array in the RS decoder, which can corrupt the syndrome buffer. The fix addresses this overflow.

In the Linux kernel scsi: xen: scsiback driver, on error paths before command submission, there is a double-put of se_cmd with refcount 0, leading to refcount underflow and tag leak. The fix adds a helper that just returns the tag and sends the error response.

A vulnerability in the Linux kernel SCSI target subsystem affects parsing of PERSISTENT RESERVE OUT buffers. The TransportID parser was not given the buffer length, allowing out-of-bounds reads via a malformed iSCSI identifier. It is reachable through any fabric delivering PR OUT to an iSCSI TPG, including vhost-scsi.

A use-after-free vulnerability was found in the Linux kernel's SCSI target subsystem, affecting the REGISTER AND MOVE operation in Persistent Reserve Out. The issue arises from using a pointer to a mapped buffer after it has been unmapped, potentially leading to reads from freed memory.

In the Linux kernel, the RT locking mechanism has a use-after-free vulnerability due to incorrect RCU protection in rt_spin_unlock(). The function releases RCU protection before unlocking, enabling a race condition that leads to use of freed memory.

In the Linux kernel, the net: mana driver lacks validation of the packet length reported by the NIC in the RX CQE. The length is passed to skb processing without verification, which can lead to errors.

In the Linux kernel, the net: mana driver lacks DMA synchronization for page pool RX fragments in the receive path. When RX buffers are allocated from page pool fragments, they are not synced for CPU before being passed to the network stack, which can cause issues in configurations requiring explicit DMA sync.

A vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver causes header buffer corruption when header-split and HW-GRO are enabled. The issue stems from incorrect indexing of header buffers by queue position instead of buffer ID, leading to wrong header reads and reuse of buffers still owned by the device when completions arrive out of order.

In the Linux kernel ESPINTCP subsystem, a vulnerability exists related to partial sends. Using sk_msg_free_partial() ensures skmsg consistency in each iteration, simplifying code and fixing bugs in skmsg accounting when not sending the full contents.

In the Linux kernel orangefs filesystem, a vulnerability exists where the directory entry size is stored in a 32-bit variable, which can wrap and bypass bounds checks, leading to out-of-bounds read and kernel panic.

In the Linux kernel, in the ip_vs_conn_new() function, the full ip_vs_seq structures are not reset, which can lead to use of uninitialized data from slab. The fix resets both struct ip_vs_seq members before publishing the connection to prevent TCP flow corruption.

In the Linux kernel's DRBD module, there is a vulnerability due to not rejecting data replies with an out-of-range payload size. A malicious or man-in-the-middle DRBD peer can send a reply with a negative size, leading to copying data beyond a bio page and corrupting kernel memory.

In the Linux kernel's IPVS, there are errors in calculating IPv6 transport offsets. The TCP app code assumed an IPv4 network header, which can cause issues with apps over IPv6. The ICMPV6 header offset was also corrected.

In the Linux kernel's IPVS, after calling skb_ensure_writable(), which may reallocate skb->head, the IP header pointer was not reloaded, potentially leading to use of a stale pointer.

In the Linux kernel ksmbd (SMB) server, FSCTL operations such as SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION operate on an open SMB handle but call VFS helpers with the current ksmbd worker credentials. This can lead to revalidation of inode permissions, ownership, and LSM policy independently of the SMB handle access mask. The fix runs each operation with the credentials captured in the target file when the handle was opened.

In the Linux kernel's ksmbd server, there is a missing validation of the minimum PDU size for transform requests. A packet with SMB2_TRANSFORM_PROTO_NUM bypasses the check, potentially leading to out-of-bounds read and disclosure of data to an unauthenticated client.

In the Linux kernel, the xfrm subsystem has a vulnerability where skb->prev becomes stale after async crypto steals a GSO segment. If the last segment is stolen, the head's ->prev pointer is not updated, leading to a write through a dangling pointer (use-after-free) in validate_xmit_skb_list(). The fix repoints skb->prev at the last retained segment before returning.

In the Linux kernel, the SMB client has a vulnerability in the fallocate function that can skip holes when the server returns an allocated range starting before the current offset. This can cause later writes to the skipped area to fail with ENOSPC.

In the Linux kernel on s390 architecture, there is a vulnerability in csum_partial() that on machines without vector facility calculates the checksum from address zero instead of the source buffer. This results in incorrect checksums.

In the Linux kernel, the SMB server (ksmbd) has a use-after-free vulnerability during asynchronous oplock break notification. The pointer to the ksmbd_conn structure is stored in an async work without proper reference counting, which can lead to access to freed memory.

In the Linux kernel, the SMB client's parse_dfs_referrals() did not validate the PathConsumed value in DFS responses. A malicious response with an oversized PathConsumed can cause subsequent DFS path parsing to advance beyond the end of the path.

In the Linux kernel, the AMT (Automatic Multicast Tunneling) module has a use-after-free vulnerability. Several packet receive and transmit paths cache a pointer to the skb header and then call functions that can reallocate the head, leaving the pointer dangling. An attacker could exploit this to escalate privileges or leak information.

In the Linux kernel SCTP subsystem, sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, bypassing authentication verification. The fix checks sctp_auth_recv_cid() in such cases and drops the chunk if authentication is required.

In the Linux kernel, a vulnerability was found in the MPTCP implementation, involving a stale skb->sk pointer to a closing subflow. The backlog cleanup was performed without proper synchronization, which could lead to a use-after-free condition.

In the Linux kernel, SCTP UDP tunnel sockets were not closed during network namespace teardown, potentially leading to races and improper state. The fix closes these sockets in sctp_ctrlsock_exit() after unregistering the sysctl table.

In the Linux kernel, a pre-auth out-of-bounds read vulnerability was found in ceph_handle_caps(). An attacker or compromised MDS can set snaptrace_len to 0xFFFFFFFF, leading to reads beyond the message buffer and further out-of-bounds reads.

In the Linux kernel's libceph module, the length of pg_temp, pg_upmap, and pg_upmap_items lists was not bounded to CEPH_PG_MAX_SIZE, potentially leading to a stack out-of-bounds write. The fix rejects entries longer than 32 during decoding.

In the Linux kernel's libceph module, a multiplication overflow during osdmap decoding can lead to incorrect bounds checking and out-of-bounds reads. The fix uses check_mul_overflow() to detect overflow and reject corrupted messages.

In the Linux kernel's libceph module, after an authorizer update, the auth->authorizer_buf may point to freed memory, leading to a use-after-free. The fix refreshes these pointers after a successful authorizer rebuild.

In the Linux kernel's libceph module, CRUSH bucket type 0 was accepted, potentially leading to indexing the OSD weight array with a negative value. The fix rejects such types during CRUSH map decoding.

In the Linux kernel's phonet module (PEP subsystem), the function pep_get_sb() does not consider that pskb_may_pull() might have relocated the skb data, and continues to access the older pointer, leading to a use-after-free. The issue was confirmed by KASAN.

In the Linux kernel's net/x25 subsystem, there is a use-after-free vulnerability in x25_kill_by_neigh(). The function walks the global X.25 socket list but does not pin the socket's lifetime after dropping the list lock. A concurrent close can free the socket, and the function then uses the freed object. The fix takes a reference with sock_hold() and rechecks the connection.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism allows re-aggregation of packets marked with the flush flag. The lack of validation in skb_gro_receive_list() leads to corruption of the frag_list chain, potentially causing a kernel panic during packet transmission.