Dmitry Vyukov

يحتوي Abseil-cpp على مشكلة تجاوز سعة مخزن الذاكرة المؤقتة (heap buffer overflow). لم تفرض طرق `sized constructors` و`reserve()` و`rehash()` الخاصة بـ `absl::{flat,node}hash{set,map}` حدًا على حجم وسيطة الإدخال الخاصة بها. وقد سمح ذلك لمهاجم خبيث بتقديم قيمة كبيرة الحجم، مما تسبب في تجاوز سعة عدد صحيح عند حساب حجم مخزن الدعم الخاص بالحاوية، مما أدى إلى كتابة خارج نطاق الذاكرة. كما أن الوصول اللاحق إلى الحاوية قد يؤدي أيضًا إلى الوصول إلى الذاكرة خارج نطاقها. وقد تسمح هذه المشكلة للمهاجم بإحداث رفض الخدمة أو تلف الذاكرة.

تم تحديد مشكلة «استخدام بعد التحرير» (use-after-free) في نواة لينكس، وتحديدًا في نظام الملفات btrfs. يحدث هذا عند محاولة الدخول إلى معاملة تم إيقافها، حيث يتم قراءة الحقل «aborted» بعد إلغاء قفل fs info->trans lock ودون الاحتفاظ بأي عداد مرجعي إضافي عليه. وهذا يسمح لمهمة متزامنة تقوم بإيقاف المعاملة بتحرير المعاملة قبل قراءة الحقل «aborted»، مما يؤدي إلى حدوث ثغرة «use-after-free». تم الإبلاغ عن المشكلة من قِبل syzbot و Dmitry، مع توفير تتبعات المكدس (stack traces) من قِبل KASAN.

تم تحديد ثغرة أمنية في نواة لينكس، تتعلق بقراءة خارج الحدود أثناء الاستعلام في الحالة xfrm. تظهر المشكلة عندما يتم تنفيذ عمليات الاستعلام وتغيير الحجم بشكل متوازٍ، وقد تلاحظ وظائف التجزئة قيمة hmask أكبر بكثير من المصفوفة الجديدة hlist. ويرجع ذلك إلى أن seqlock xfrm state hash generation يضمن إجراء محاولة جديدة، ولكنه لا يمنع وظائف التجزئة من الوصول إلى قيمة hmask غير متسقة. يمكن استغلال هذه الثغرة الأمنية عندما لا يتم مزامنة تحديث state bydst بشكل صحيح مع دالة الاستعلام.

A use-after-free flaw was found in `qdisc graft` in `net/sched/sch api.c` in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. The issue can be exploited to cause a denial of service.

The issue is related to a null pointer dereference in the tipc component of the Linux kernel. Specifically, the function `tipc aead init()` is vulnerable, and exploitation can lead to a denial of service. The problem arises because `kmemdup` can return a null pointer, which is not checked, resulting in a null key being dereferenced later in `tipc crypto key xmit`.

The issue is related to the handling of the hrtimer in the mac80211-hwsim module. When the timer fires late due to vCPU scheduling, it attempts to rearm the timer at the next deadline, which may be in the past. This behavior is incorrect and can cause stalls. The correct approach is to align the beacons to the TBTT (Target Beacon Transmission Time) and resume at the current point if late. The code has been changed to use `hrtimer forward now()` to ensure the next firing of the timer is at the next interval point after the current time.

The issue allows attackers to obtain potentially sensitive information from kernel memory. This is related to a write mmio stack-based out-of-bounds read in the KVM implementation, specifically in the files arch/x86/kvm/x86.c and include/trace/events/kvm.h.

The issue concerns the x86/fpu subsystem in the Linux kernel, which does not correctly handle attempts to set reserved bits in the xstate header via the `ptrace()` or `rt sigreturn()` system call when a processor supports the xsave feature but not the xsaves feature. This allows local users to read the FPU registers of other processes on the system.

The issue is related to a NULL pointer dereference in the Linux kernel, specifically in the net/ipv4/route.c file. This allows local users to cause a denial of service or possibly have other unspecified impacts via crafted system calls. The problem is associated with errors in pointer handling.

A race condition exists in the Linux kernel, allowing local users to cause a denial of service, such as a system crash, via crafted system calls. This issue is related to incorrect interaction between `put ucounts` and `get ucounts` due to certain decrement behavior.

The issue is related to the improper management of lock dropping by the `hashbin delete` function in the Linux kernel, which can be exploited by local users to cause a denial of service (deadlock) through crafted operations on IrDA devices.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and soft lockup. This can be achieved via vectors involving a TCP packet with the URG flag. The `tcp splice read` function in `net/ipv4/tcp.c` is the vulnerable component.

The issue is related to errors in resource management in the `nested vmx check vmptr` function of the Linux operating system. This can be exploited by a local attacker to cause a denial of service, specifically through memory consumption. The `nested vmx check vmptr` function in the Linux kernel improperly emulates the VMXON instruction, allowing KVM L1 guest OS users to cause a denial of service by leveraging the mishandling of page references.

The issue allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt.

The issue is related to the netfilter subsystem in the Linux kernel, which mishandles IPv6 reassembly. This can be exploited by local users via a crafted application that makes socket, connect, and writev system calls, potentially leading to a denial of service (integer overflow, out-of-bounds write, and GPF) or other unspecified impacts.

The issue allows guest OS users to gain host OS privileges or cause a denial of service, resulting in an out-of-bounds array access and host OS crash, via a crafted interrupt request when I/O APIC is enabled. This is related to the files arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.

The issue allows local users to obtain sensitive information from kernel stack memory via a crafted application due to improper initialization of Code Segment (CS) in certain error cases.

A race condition exists in the get task ioprio function, allowing local users to potentially gain privileges or cause a denial of service through a crafted ioprio get system call. This issue can lead to a use-after-free scenario.

The issue is related to a use-after-free vulnerability in the ` sys recvmmsg` function, located in the net/socket.c file of the Linux kernel. This vulnerability can be exploited by remote attackers to execute arbitrary code through vectors involving a recvmmsg system call that is mishandled during error processing.

The issue allows local users to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This occurs when a crafted application does not supply a key, related to the `lrw crypt` function.