Aaron Esau

توجد مشكلة تحرير مزدوج في تنفيذ خدمة التسليم الموثوق (RDS) في نواة Linux. عندما تفشل الدالة `iov iter get pages2()` داخل `rds message zcopy from user()`، يتم تحرير الصفحات المثبتة ومسح `rm->data.op mmp znotifier`، ولكن لا تتم إعادة تعيين المتغير `rm->data.op nents` بشكل صحيح. ونتيجة لذلك، عند استدعاء `rds message purge()` لاحقًا من `rds sendmsg()`، تتكرر حلقة التنظيف على القيمة غير الصحيحة غير الصفرية لـ `op nents`، مما يؤدي إلى محاولة ثانية لتحرير الموارد نفسها.

An unauthenticated stack-based buffer overflow vulnerability in common.c's handle PORT can be abused to cause a crash and could potentially lead to remote code execution.

The issue arises from improper implementation of a chroot jail in the `compose abspath` function in common.c, leading to multiple unauthenticated directory traversal vulnerabilities in different FTP commands. This can be exploited to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.

The issue allows an unauthenticated user to perform a directory traversal attack using multiple different FTP commands, enabling them to read and write to arbitrary locations on the filesystem. This is due to the lack of a well-written chroot jail in the `compose abspath()` function.

The issue is caused by a buffer overflow in the handle PORT function in ftpcmd.c. This occurs when a 16-byte buffer is filled with user input via sprintf() using the format specifier string %d.%d.%d.%d. Although the 16-byte size is sufficient for valid IPv4 addresses, the %d format specifier allows for more than 3 digits, leading to a potential overflow.