Krzysztof Kozlowski

تم تحديد ثغرة أمنية في نواة لينكس، تتعلق بغياب حاجز القراءة في الدالة `qcom scm get tzmem pool()`. قد تؤدي هذه المشكلة إلى الحصول على قيمة قديمة للمتغير ` scm`، مما قد يؤدي إلى إشارة إلى مؤشر NULL. نشأت المشكلة عن عملية «commit» أدخلت حاجز كتابة دون وجود حاجز قراءة مطابق، وهو أمر ضروري للوصول إلى المتغير ` scm` من سياقات متزامنة.

تم إصلاح ثغرة أمنية في نواة لينكس. تحدث المشكلة عندما يفشل برنامج تشغيل SCM أثناء عملية الفحص (probe)، مع بقاء المتغير العام ’ scm‘ مُعيَّنًا. قد يؤدي ذلك إلى اعتقاد المستخدمين الخارجيين للبرنامج التشغيلي أن عملية الفحص قد اكتملت بنجاح، مما قد يؤدي إلى حدوث استثناء مؤشر NULL. تنشأ المشكلة نتيجة إدخال تأجيل عملية الفحص في برنامج التشغيل SCM.

تم حل مشكلة في نواة لينكس، وتحديدًا في البرنامج الثابت qcom scm smc. كانت المشكلة تتعلق بمعالجة جهاز SCM غير موجود. تم إجراء تعديل برمجي (commit) لمعالجة الحالة التي قد تُرجع فيها الدالة qcom scm get tzmem pool() القيمة NULL بشكل صريح، مما يضمن للمستخدمين إدارة هذه الحالة بشكل مناسب.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the Linux kernel, specifically the ASoC: qcom: sc7280 component. A commit moved the allocation of Soundwire stream runtime from the Qualcomm Soundwire driver to individual machine sound card drivers, but forgot to update the SC7280 card. This results in a NULL pointer dereference or other effects of uninitialized memory accesses during sound playback, similar to an issue confirmed on SDM845. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the `st dwc3 probe()` function in the Linux kernel, which is associated with the reuse of previously freed memory. This can lead to an impact on the confidentiality, integrity, and availability of protected information. The problem arises from the probe function not performing any platform device allocation, making the error path "undo platform dev alloc" unnecessary. This drops the reference count from the platform device being probed, potentially resulting in unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources.

The issue is related to a use-after-free vulnerability in the Linux kernel, specifically in the hci qca driver. This vulnerability occurs when the driver shutdown callback is invoked on a closed serdev, causing a use-after-free error during system reboot with Qualcomm Atheros Bluetooth. The vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information.

The vulnerability is related to a slab-out-of-bounds issue in the `handle rx uart` function of the `qcom-geni-serial` driver. This occurs when the RX FIFO depth is updated after the probe, causing the RX UART handle code to read beyond the bounds of the `port->rx fifo` buffer. The issue can be observed in certain configurations with Qualcomm Bluetooth HCI UART devices and KASAN. Technical details about exploitation include: - The `qcom geni serial port setup` function updates the RX FIFO depth (`port->rx fifo depth`) to match real device capabilities. - The RX UART handle code reads `port->rx fifo depth` number of words into the `port->rx fifo` buffer, thus exceeding the bounds. - Vulnerable function names include `handle rx uart`, `qcom geni serial handle rx`, and `qcom geni serial isr`.

The issue is related to a potential NULL pointer dereference in the `nfc genl dump ses done()` function. This function should check if the received argument is non-NULL because its allocation could fail earlier in `dumpit()` (`nfc genl dump ses()`).

The issue is related to a memory leak in the Linux kernel, specifically in the fsl ifc driver. On probe error, the driver fails to free the memory allocated for the private structure, which can lead to a memory leak. The fix involves using resource-managed allocation to address this issue.

The issue is related to a memory leak in the Linux kernel, specifically in the fsl ifc driver. On probe error, the driver fails to unmap IO memory, leading to a memory leak. The Smatch report warns that `fsl ifc ctrl dev->gregs` is not released on lines 298 in the `fsl ifc ctrl probe()` function.

The issue concerns the Linux kernel, where various PV features (Async PF, PV EOI, steal time) work through memory shared with the hypervisor. When restoring from hibernation, these features must be properly torn down to prevent the hypervisor from writing to stale locations after jumping to the previously hibernated kernel. The job is already done for secondary CPUs by kvm cpu down prepare(), and syscore ops are registered to do the same for the boot CPU.

A possible NULL pointer dereference of resource issue has been resolved in the Linux kernel. The `platform get resource byname()` function can return NULL, which would be immediately dereferenced by `resource size()`. To fix this, the resource is now dereferenced after validation.