Sabrina Dubroca

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** نواة لينكس (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يحدث تسرب في عداد المراجع في `struct xfrm state` داخل نواة لينكس. تنشأ هذه المشكلة لأن الدالة `xfrm dev unregister()` تم تنفيذها كعملية خالية من التأثير (no-op)، على الرغم من أن الدالة `xfrm dev state add()` (التي يتم استدعاؤها عبر `xfrm state construct()`) تحصل على مرجع إلى `struct net device`. ونتيجة لذلك، عند حدوث حدث `NETDEV UNREGISTER`، لا يتم تحرير المرجع إلى جهاز الشبكة بشكل صحيح، مما يؤدي إلى تسرب في الذاكرة. وتتفاقم المشكلة عندما يتم مسح بت `NETIF F HW ESP` بعد الحصول على المرجع، حيث يفشل النظام في مسح الحالة والسياسة بشكل غير مشروط. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the igb driver in the Linux kernel, which does not handle large MAX SKB FRAGS values properly. Setting MAX SKB FRAG to 45 causes payload corruption on TX. The root cause of the issue is that the driver does not take into account properly the shared info size when selecting the ring layout, and will try to fit two packets inside the same 4K page even when the 1st fraglist will trump over the 2nd head. An easy reproducer is to run ssh to connect to the machine, which works with MAX SKB FRAGS=17 but fails with MAX SKB FRAGS=45. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a memory leak in the Linux kernel's ipv6 component, specifically in the seg6 hmac init algo function. This function returns without cleaning up previous allocations if one fails, leading to a memory leak and potential denial of service. The vulnerability can be exploited to cause a denial of service. **Recommendations** Update the Linux kernel to a version that includes the fix for the memleak in seg6 hmac init algo. As a temporary workaround, consider disabling the seg6 hmac init algo function until a patch is available. Restrict access to the ipv6 component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in the Linux kernel's TLS implementation. When the decrypt request goes to the backlog and `crypto aead decrypt` returns `-EBUSY`, `tls do decryption` will wait until all async decryptions have completed. If one of them fails, `tls do decryption` will return `-EBADMSG` and `tls decrypt sg` jumps to the error path, releasing all the pages. However, the pages have been passed to the async callback and have already been released by `tls decrypt done`. The only true async case is when `crypto aead decrypt` returns `-EINPROGRESS`. With `-EBUSY`, the kernel has already waited, so it can tell `tls sw recvmsg` that the data is available for immediate copy, but it needs to notify `tls decrypt sg` (via the new `->async done` flag) that the memory has already been released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue exists in the TLS (Transport Layer Security) implementation within the `net/tls/tls sw.c` module. The problem occurs because the `tls decrypt sg()` function fails to take a reference on the pages from `clear skb`. Consequently, the `put page()` function within `tls decrypt done()` releases these pages prematurely. This leads to a use-after-free condition in the `process rx list()` function when attempting to read from a partially-read skb (socket buffer). This flaw can impact the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.