Anatoly Trosinenko

The issue is related to a buffer overflow in the NFSD component of the Linux kernel. If a client sends a READDIR count argument that is too small, the buffer size calculation results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect, and NFSD has never checked the READDIR count argument. The problem was exposed when entry encoding changed, affecting the pointer arithmetic in xdr reserve space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request, and there are no unit tests that exercise the behavior of READDIR at the lower bound of @count values.

The issue is related to a buffer data boundary operation overflow in QEMU, which can be exploited to access confidential data, compromise data integrity, and cause a denial of service. Specifically, the `hw/pci/msix.c` file in QEMU allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

The vulnerability is related to the bpf verifier in the Linux kernel, which did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This issue affects the Linux 5.4 stable series and newer versions. The vulnerability can be exploited to escalate privileges, allowing an attacker to gain root access. A working exploit exists but has not been publicly released. The vulnerability is present in the eBPF subsystem, which allows running handlers for tracing, analyzing subsystems, and managing traffic within the kernel.