CWE-401

Podatność w jądrze Linux w funkcji extract_iter_to_sg (lib/scatterlist.c) powoduje nieprawidłowe obliczenia długości podczas przetwarzania kvec oraz buforów użytkownika w strukturach scatterlist. Mimo oceny CVSS 9.8, w opisie nie potwierdzono aktywnego wykorzystania tej luki.

W sterowniku sieciowym ice w jądrze Linux istnieje podatność powodująca wyciek pamięci (memory leak) przy przetwarzaniu wielobufferowych ramek odbiorczych (Rx). Podatność może być zdalnie wywołana przez dostarczenie odpowiednio spreparowanych ramek sieciowych, co prowadzi do wyczerpania zasobów systemowych.

Podatność w podsystemie netmem jądra Linux umożliwia przekazanie nieczytelnych pakietów (unreadable skbs) do ścieżki transmisji (TX) urządzenia sieciowego. Może to prowadzić do przekazania nieprawidłowych adresów DMA do interfejsu sieciowego, skutkując poważnymi konsekwencjami dla bezpieczeństwa i stabilności systemu.

Podatność w podsystemie netfilter jądra Linux (moduł nf_set_pipapo) polega na nieprawidłowej inicjalizacji bufora mapy wyszukiwania, co prowadzi do błędnych wyników dopasowania reguł filtrowania. Błąd ma krytyczną ocenę CVSS 9.8 i może umożliwić obejście reguł zapory sieciowej.

Podatność w podsystemie NFSD jądra Linux powoduje wyciek pamięci (memory leak) przy jednoczesnym przetwarzaniu żądań otwarcia pliku NFS przez wiele wątków serwera. Błąd może prowadzić do wyczerpania zasobów systemowych oraz uszkodzenia stanu serwera NFS.

Podatność w sterowniku hv_netvsc jądra Linux umożliwia zwolnienie odszyfrowanej (współdzielonej) pamięci do alokatora stron w przypadku niepowodzenia operacji set_memory_decrypted(). Może to prowadzić do poważnych problemów funkcjonalnych lub bezpieczeństwa w środowiskach Confidential Computing (CoCo VM).

W jądrze Linux wykryto podatność typu memory leak (CWE-401) w podsystemie SUNRPC, w funkcji gssx_dec_option_array. Pomimo oceny CVSS 9.8, błąd polega na braku zwolnienia zaalokowanej pamięci w ścieżkach obsługi błędów, co może prowadzić do wyczerpania zasobów systemowych.

Podatność w module virt/tdx-guest jądra Linux umożliwia niezaufanemu hostowi doprowadzenie do sytuacji, w której odszyfrowana (współdzielona) pamięć trafia z powrotem do alokatora stron. Może to prowadzić do problemów funkcjonalnych lub naruszenia bezpieczeństwa w środowiskach CoCo VM (Confidential Computing).

Podatność w sterowniku VMBus jądra Linux powoduje, że w środowiskach CoCo VM (Confidential Computing) niezaszyfrowane (współdzielone) strony pamięci mogą zostać zwrócone do alokatora stron po nieudanym wywołaniu set_memory_encrypted(). Stanowi to poważne zagrożenie bezpieczeństwa, ponieważ niezaszyfrowana pamięć może zostać ujawniona lub skompromitowana przez niezaufanego hosta.

Wyciek pamięci (memory leak) w implementacji ICMPv6 w Linux Kernel 5.13 i nowszych umożliwia zdalnemu atakującemu doprowadzenie hosta do stanu braku pamięci (out-of-memory). Podatność nie wymaga uwierzytelnienia ani interakcji użytkownika, co czyni ją szczególnie niebezpieczną w środowiskach eksponowanych na ruch sieciowy IPv6.

In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()").

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long time, randomly an RX descriptor filled with value "0" from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id "0") to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time. Changed the start id for idr allocation to "1" and the buffer id "0" is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB. Crash Signature : Unable to handle kernel paging request at virtual address 3f004900 PC points to "b15_dma_inv_range+0x30/0x50" LR points to "dma_cache_maint_page+0x8c/0x128". The Backtrace obtained is as follows: [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

In the Linux kernel, the following vulnerability has been resolved: net: mctp: unshare packets when reassembling Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info. The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs. A kunit test is added to reproduce the issue.

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Remove cache tags before disabling ATS The current implementation removes cache tags after disabling ATS, leading to potential memory leaks and kernel crashes. Specifically, CACHE_TAG_DEVTLB type cache tags may still remain in the list even after the domain is freed, causing a use-after-free condition. This issue really shows up when multiple VFs from different PFs passed through to a single user-space process via vfio-pci. In such cases, the kernel may crash with kernel messages like: BUG: kernel NULL pointer dereference, address: 0000000000000014 PGD 19036a067 P4D 1940a3067 PUD 136c9b067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 74 UID: 0 PID: 3183 Comm: testCli Not tainted 6.11.9 #2 RIP: 0010:cache_tag_flush_range+0x9b/0x250 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x163/0x590 ? exc_page_fault+0x72/0x190 ? asm_exc_page_fault+0x22/0x30 ? cache_tag_flush_range+0x9b/0x250 ? cache_tag_flush_range+0x5d/0x250 intel_iommu_tlb_sync+0x29/0x40 intel_iommu_unmap_pages+0xfe/0x160 __iommu_unmap+0xd8/0x1a0 vfio_unmap_unpin+0x182/0x340 [vfio_iommu_type1] vfio_remove_dma+0x2a/0xb0 [vfio_iommu_type1] vfio_iommu_type1_ioctl+0xafa/0x18e0 [vfio_iommu_type1] Move cache_tag_unassign_domain() before iommu_disable_pci_caps() to fix it.

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi->mac_filter_hash. The leak occurs when multiple threads attempt to modify the mac_filter_hash simultaneously, leading to inconsistent state and potential memory leaks. To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock), ensuring atomic operations and preventing concurrent access. Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in i40e_add_mac_filter() to help catch similar issues in the future. Reproduction steps: 1. Spawn VFs and configure port vlan on them. 2. Trigger concurrent macvlan operations (e.g., adding and deleting portvlan and/or mac filters). 3. Observe the potential memory leak and inconsistent state in the mac_filter_hash. This synchronization ensures the integrity of the mac_filter_hash and prevents the described leak.

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM effectively corrupts guest memory during live migration by writing to guest memory without informing userspace that the page is dirty. Marking the page dirty got unintentionally dropped when KVM's emulated CMPXCHG was converted to do a user access. Before that, KVM explicitly mapped the guest page into kernel memory, and marked the page dirty during the unmap phase. Mark the page dirty even if the CMPXCHG fails, as the old data is written back on failure, i.e. the page is still written. The value written is guaranteed to be the same because the operation is atomic, but KVM's ABI is that all writes are dirty logged regardless of the value written. And more importantly, that's what KVM did before the buggy commit. Huge kudos to the folks on the Cc list (and many others), who did all the actual work of triaging and debugging. base-commit: 6769ea8da8a93ed4630f1ce64df6aafcaabfce64

imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().

mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.

Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.