Florian Westphal

The vulnerability is related to a memory leak in the `nft flow offload` component of the Linux kernel. Specifically, the issue arises when the direct xmit path is used, and the `dst release()` function is called. This can lead to an unreferenced object, as reported by `kmemleak`. The vulnerability may allow an attacker to cause a denial of service. Technical details include the involvement of functions such as `kmem cache alloc()`, `dst alloc()`, and `nft flow offload eval()`.

The issue is related to a null pointer dereference flaw in the nft inner.c functionality of netfilter in the Linux kernel. This flaw could allow a local user to crash the system or escalate their privileges on the system.

The issue is related to a memory leak in the netfilter component of the Linux kernel during the update of stateful objects. Stateful objects can be updated from the control plane, and the transaction logic allocates a temporary object for this purpose. However, the `->init` function was called for this object, resulting in a memory leak when using `kfree()`. To fix this, the `->destroy` function of the object should be called, which is done by `nft obj destroy()`. This function also decrements the module refcount, but the update path does not increment it. The solution involves doing `module get` for the update case and releasing it via `nft obj destroy()`.

يحدث تسرب مرجعي في نواة Linux عند التبديل بين المناطق أو مساحات أسماء الشبكة دون مسح إدخال تتبع الاتصال (ct) بينهما. يحدث هذا لأن الدالة `tcf ct skb nfct cached()` تُرجع القيمة false وقد تقوم الدالة `tcf ct flow table lookup()` بالكتابة فوق إدخال ct القديم. تنشأ المشكلة من عدم قابلية إعادة استخدام إدخال ct.

The issue is related to the mptcp component of the Linux kernel, which can cause a crash due to a null pointer dereference. This occurs when the `sk->sk sock kern` flag is not set correctly, allowing `setsockopt` to work for plain TCP sockets. In the case of a fallback, `accept()` can return a plain TCP socket that is still tagged as 'kernel', leading to a crash. The subflow extension has a NULL `ctx->conn` mptcp socket, resulting in a null pointer dereference in `subflow data ready`.

The issue is related to cmd5checkpw, which does not properly drop privileges when running setuid. This allows local users to read the poppasswd file by exploiting the improper privilege handling before the execvp function is called.

The issue is caused by an integer underflow in the Lists MakeMask() function, which can lead to a denial of service (application crash) and potentially allow the execution of arbitrary code. This occurs when a remote attacker sends a long MODE line, causing an incorrect length calculation and resulting in a buffer overflow.