dbugs — CVE Database, Vulnerability Trends & Research

A use-after-free issue exists in the Linux kernel's IPv4 TCP stack during the handling of incoming connection requests. The `tcp v4 syn recv sock()` function transfers ownership of `ireq->ireq opt` to a child socket without copying it. If the child socket is freed while another CPU is concurrently processing a retransmitted SYN and reading those options via `tcp v4 send synack()` or `inet csk route req()`, a use-after-free occurs in `ip options build()`. A similar issue affects request socket migration when `net.ipv4.tcp migrate req` is enabled or a `BPF SK REUSEPORT SELECT OR MIGRATE` program is used, where `tcp v4 reqsk destructor()` uses a plain `kfree()` instead of `kfree rcu()`. A remote, unauthenticated attacker can exploit this by sending connection requests with IPv4 Record Route or Timestamp options to cause a denial of service or potentially execute arbitrary code as root, especially on servers using Multipath TCP (MPTCP). Read-Copy-Update (RCU) is a synchronization mechanism that allows multiple readers to access data while it is being updated.

An issue in the `MetadataUploader` function of the Visual Composer tool within the SAP NetWeaver platform allows unauthenticated remote attackers to upload unrestricted executable binaries. This is caused by inadequate validation of model files and flaws in the deserialization mechanism. Attackers can send specially crafted HTTP POST requests containing malicious ZIP or JAR files (often as `application/octet-stream`), which the server erroneously processes as safe content, leading to remote code execution (RCE) and full system compromise. Real-world exploitation has been documented, including activities by China-nexus APTs and groups such as Lapsus and Shinyhunters. These attacks have involved the deployment of web shells (e.g., `helper.jsp` and `cache.jsp`) and a Linux backdoor named Auto-Color to maintain persistent access, steal data, and move laterally within networks.