Dann Frazier

سمحت حزم البرامج الثابتة UEFI edk2 الخاصة بـ Ubuntu عن غير قصد بالوصول إلى Shell UEFI في بيئات Secure Boot، مما قد يؤدي إلى التحايل على إجراءات الحماية الخاصة بـ Secure Boot. كانت الإصدارات السابقة تتضمن آلية تعتمد على Secure Boot للحفاظ على التشغيل داخل Shell، والتي تُعتبر مناسبة لتطبيق قيود Secure Boot. يمثل هذا المشكل تصحيحًا إضافيًا يتعلق بتصحيح سابق غير مكتمل.

تنشأ المشكلة نتيجة هجوم DDoS على المنفذ TCP 22، مما يتسبب في حدوث عطل في النواة. تنشأ هذه المشكلة من عملية «backport» لالتزام (commit) متعلق بـ `nft lookup` دون تضمين التصحيحات اللاحقة.

The issue is related to the GTDT driver in the Linux kernel. When the driver probe fails due to invalid firmware properties, it unmaps the interrupt that it mapped earlier. However, it does not check whether the mapping of the interrupt actually succeeded. If the firmware reports an illegal interrupt number that overlaps with the GIC SGI range, this can result in an IPI being unmapped, leading to subsequent issues. The driver has been reworked to have a saner behavior and actually check whether the interrupt has been mapped before unmapping things.

The issue is related to an untrusted search path vulnerability. It allows local users to execute arbitrary code via a Trojan horse `import pxe files` configuration file in the current working directory.

The issue allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames. This is achieved by sending one frame that omits an SSID Information Element (IE) and a subsequent frame that contains an SSID IE, which triggers a NULL pointer dereference in the `cmp ies` function.

The issue allows local users to cause a denial of service, resulting in a "soft lockup" and process loss. This occurs when a large number of `sendmsg` function calls are made, which does not block during AF UNIX garbage collection and triggers an OOM condition.

The issue is related to multiple vulnerabilities in the Linux kernel, specifically in the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely, leading to a disruption of protected information. The exploitation can be carried out through various means, including the TSB I-TLB load implementation in arch/sparc/kernel/tsb.S, which does not properly obtain the value of a certain PAGE EXEC 4U bit, making it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application.