Kees Cook

The issue is related to the Linux kernel, specifically with the binfmt flat format. A RISC-V specific variant of this format was introduced, which does not allocate space for the array of shared library pointers. However, the code that initializes this array was not disabled, resulting in the corruption of sizeof(long) bytes before the DATA segment. This corruption generally occurs at the end of the TEXT segment. To address this, MAX SHARED LIBS UPDATE was introduced, which depends on the state of CONFIG BINFMT FLAT NO DATA START OFFSET to guard the initialization of the shared library pointer region. This ensures that the region is only initialized if space is reserved for it.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a memory corruption vulnerability in the Linux kernel's kunit/fortify component, specifically in the function DEFINE ALLOC SIZE TEST PAIR(). This vulnerability can be exploited to gain access to confidential information. The problem arises from the incorrect usage of kvalloc() and vfree() instead of kvfree() in the kv*() family of tests. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue arises when unloading a modular pstore backend with records in pstorefs, triggering a dput() double-drop warning. This warning occurs due to the incorrect use of `d drop()` and `dput()` as mentioned in Documentation/filesystems/vfs.rst, leading to a reference counting problem. The solution involves using `d invalidate()` and updating the code to not check for error codes that can never happen.

The issue is related to the `ms lib process bootblock()` function in the `ene ub6250.c` module of the ENE UB6250 reader driver in the Linux kernel. It is associated with accessing memory beyond the allocated buffer. Exploitation of this issue could allow a remote attacker to cause a denial of service. An object could potentially extend beyond the end of an allocation.

The issue is related to a field-overflowing memcpy() in the net/mlx5e module of the Linux kernel. In preparation for FORTIFY SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), the code has been modified to avoid intentionally writing across neighboring fields. The vulnerability occurs when the compiler sees the target as being 2 bytes in size, but 18 bytes are copied, intending to write across the start, which is really vlan tci, 2 bytes. The remaining 16 bytes get written into wqe->data[0], covering byte count, lkey, and addr.

تم إصلاح ثغرة أمنية في نواة لينكس، وتحديدًا مشكلة قراءة خارج النطاق (OOB) عند معالجة سجل Post Cursor2. تم اكتشاف المشكلة في الدالة `drm dp get adjust request post cursor`، حيث لم يكن حجم المصفوفة `link status` كافيًا لقراءة سجل Adjust Request Post Cursor2. وقد أدى ذلك إلى حدوث خطأ قراءة خارج الحدود (OOB). تم تحديد الثغرة الأمنية أثناء عملية تجميع باستخدام الخيار `-Warray-bounds`.

The issue is related to a function in the Linux kernel's amdgpu driver, specifically the `validate bksv()` function in the `hdcp1 execution.c` module. This function is vulnerable to a buffer over-read, which could result in corrupted values if the trailing bytes are non-zero. The vulnerability can be exploited by a remote attacker to impact the confidentiality and availability of protected information. The vulnerability occurs because the code reads 8 bytes instead of the desired 5 bytes of the target field. To fix this, an appropriately sized and zero-initialized bounce buffer is used, and only 5 bytes are read before casting to `u64`.

A heap buffer overflow was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards, which may allow an attacker to overflow 49 bytes.

A race condition was discovered in the Linux drivers for Nvidia graphics, allowing an attacker to exfiltrate kernel memory to userspace.

A Memory Corruption issue exists due to an unknown function in the file proc/driver/nvidia/registry.

The issue allows a root user to remove arbitrary files.

The issue is related to the XMLWriter component in PHP, where a memory leak occurs due to the failure to release resources after their expiration. This can be exploited by a remote attacker to disclose protected information. Specifically, passing invalid UTF-8 strings via the `xmlTextWriterWriteAttribute` function can cause libxml2 to misparse them, resulting in a memory leak in the output.

The issue arises from an unchecked sscanf() call, which allows an insecure temporary settings file to overflow a static-sized buffer on the stack.

In OpenCV calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation.

The issue allows physically proximate attackers to cause a denial of service or obtain sensitive information from kernel memory via a crafted device. This is related to the Human Interface Device (HID) subsystem when CONFIG HID LOGITECH DJ is enabled.

The issue is related to the Human Interface Device (HID) subsystem in the Linux kernel, which allows physically proximate attackers to cause a denial of service via a crafted device. This is due to a lack of input sanitization in the HID driver for various Logitech devices with feedback, leading to a heap-based out-of-bounds write. The affected components include drivers/hid/hid-lgff.c, drivers/hid/hid-lg3ff.c, and drivers/hid/hid-lg4ff.c.

The issue affects the Human Interface Device (HID) subsystem in the Linux kernel. It allows physically proximate attackers to cause a denial of service via a crafted device. This is due to a heap-based out-of-bounds write in the `drivers/hid/hid-pl.c` file when `CONFIG HID PANTHERLORD` is enabled.

The issue is related to a lack of input data clearing in the HID driver for Zeroplus game controllers, leading to a local denial of service. Specifically, in the Linux kernel, the `drivers/hid/hid-zpff.c` file in the Human Interface Device (HID) subsystem is affected when `CONFIG HID ZEROPLUS` is enabled. This allows physically proximate attackers to cause a denial of service via a crafted device, resulting in a heap-based out-of-bounds write.

The issue allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device. This is related to the Human Interface Device (HID) subsystem when CONFIG HID NTRIG is enabled.

The issue is related to multiple array index errors in the Human Interface Device (HID) subsystem, specifically in the drivers/hid/hid-core.c file. This allows physically proximate attackers to potentially execute arbitrary code or cause a denial of service due to heap memory corruption. The attack can be initiated via a crafted device that provides an invalid Report ID.