Mikhail Gavrilov

تم إصلاح ثغرة أمنية في نواة Linux تتعلق بمكون ALSA memalloc. تحدث المشكلة عند تمكين الخيار CONFIG DMA API DEBUG، مما يؤدي إلى ظهور تنبيه بشأن فشل برنامج تشغيل الجهاز في التحقق من أخطاء التعيين. يتم تشغيل التنبيه بواسطة الدالة `dma mapping error()`، التي يُوصى باستخدامها للتحقق من عناوين DMA التي يتم إرجاعها. يرتبط هذا الثغرة الأمنية ببرنامج تشغيل الجهاز `snd hda intel` وتشمل الدوال `debug dma unmap page()` و`snd dma wc free()` و`snd pcm lib free pages()` و`snd pcm common ioctl()` و`snd pcm ioctl()`.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A subtle bug has been found in the Linux kernel's maple tree implementation, which can cause tree corruption when performing a spanning store across two leaf nodes. This bug has been present since the inception of the algorithm and seems to occur more frequently after a specific commit. The issue arises when the store completely consumes the right-mode node, resulting in the `mas wr spanning store()` function mistakenly duplicating new and existing entries at the maximum pivot within the range. A fix patch has been created to detect and disallow this scenario, and a test has been included to reliably reproduce the issue and assert that the fix works correctly. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Linux kernel has a vulnerability that can cause rare kernel crashes due to bad page status error messages. This issue is caused by a race condition between thread A allocating an extent buffer and thread B releasing a page, leading to a refcount underflow and eventually causing a BUG ON() on the page->mapping. The condition is not easy to hit and requires specific circumstances, such as the release being triggered for the middle page of an extent buffer. The vulnerability was introduced by a commit that changed the sequence of allocating a new extent buffer.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0 Description: The issue is related to a use-after-free vulnerability in the `mt7921 irq handler` function. This vulnerability can be exploited to cause a denial of service. The vulnerability occurs when the shared irq handler is not able to handle an unexpected event after deregistration, leading to a use-after-free condition. Recommendations: To resolve this issue, update the Linux kernel to a version that includes the fix for the use-after-free vulnerability in the `mt7921 irq handler` function. As a temporary workaround, consider disabling the `mt7921 irq handler` function until a patch is available.

The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

The issue is related to a buffer overflow due to unchecked input size, which could allow a remote attacker to gain unauthorized access to information and compromise its integrity and availability. There are memory safety bugs present, some of which show evidence of memory corruption, and it is presumed that these could be exploited to run arbitrary code with enough effort.