Sasha Levin

تم تحديد مشكلة في عد المراجع في نواة Linux، وتحديدًا في الدالة atmel nand controller init. تحدث هذه المشكلة في عدة مسارات لمعالجة الأخطاء حيث تُرجع الدالة رمز خطأ دون موازنة عد المراجع للكائن `nc->dmac` بشكل صحيح، والذي تم زيادته مسبقًا بواسطة `dma request channel()`. قد يؤدي ذلك إلى تسربات في عد المراجع.

تم إصلاح ثغرة أمنية في نواة لينكس. تحدث المشكلة عندما يفشل برنامج تشغيل SCM أثناء عملية الفحص (probe)، مع بقاء المتغير العام ’ scm‘ مُعيَّنًا. قد يؤدي ذلك إلى اعتقاد المستخدمين الخارجيين للبرنامج التشغيلي أن عملية الفحص قد اكتملت بنجاح، مما قد يؤدي إلى حدوث استثناء مؤشر NULL. تنشأ المشكلة نتيجة إدخال تأجيل عملية الفحص في برنامج التشغيل SCM.

The issue concerns a NULL dereference in the `nfsd4 process cb update()` function. Specifically, the `@ses` variable is initialized to NULL. If the ` nfsd4 find backchannel()` function does not find an available backchannel session, the `setup callback client()` function will attempt to dereference `@ses`, resulting in a segmentation fault.

تم تحديد ثغرة محتملة من نوع تعطل التزامن (deadlock) ABBA في نواة Linux، وتحديدًا في وحدة netfilter IDLETIMER. تحدث هذه المشكلة عندما يتم حذف القاعدة الأخيرة التي تشير إلى idletimer معين في نفس الوقت الذي تتم فيه قراءة ملفه في sysfs، مما يؤدي إلى احتمال حدوث تعطل التزامن الدائري. يتم توفير أداة بسيطة لإعادة إنتاج هذه المشكلة، توضح كيف يمكن أن يحدث التعطل. يتم حل الثغرة الأمنية عن طريق تحرير `list mutex` فور إزالة العنصر من القائمة، ثم المضي قدمًا في عملية إلغاء التثبيت.

A use-after-free issue was encountered in the Linux kernel, specifically in the net/smc component. This issue manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. The problem is caused by repeated release of LGR/link refcnt, potentially due to smc conn free() being called repeatedly without sock lock protection.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, related to the `net: arc` module, specifically with the `dma map single` and `dma unmap single` functions. The issue arises because `ndev->dev` and `pdev->dev` are not the same device, and using `ndev->dev.parent` is necessary as it has a `dma mask`. This vulnerability could cause a warning, as seen in the kernel log, indicating a potential issue with CPU and PID. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

تتعلق المشكلة بتلف الذاكرة الناجم عن مؤشرات المصفوفة خارج النطاق. لحل هذه المشكلة، تمت إضافة عمليات تحقق لضمان بقاء مؤشرات المصفوفة ضمن النطاق المسموح به، وتحديدًا في مكون drm/amd/display في نواة Linux.

A critical vulnerability in the Linux kernel's PCI keystone component has been fixed. The issue involved the `ks pcie quirk()` function, where an if-statement expression accidentally used `&&` instead of `||`, potentially resulting in a NULL dereference. This fix corrects the if-statement expression to use the correct condition.

The issue occurs when a monitor connected after an MST hub is unplugged, resulting in a null pointer dereference. This happens because `dc sink` is released immediately in `early unregister()` or `detect ctx()`, and committing a new state that refers to information stored in `dc sink` causes a null pointer dereference. The problem is resolved by removing a redundant checking condition and resetting `dsc aux` to NULL when the connector is disconnected.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A string buffer overrun vulnerability has been resolved in the Linux kernel. The issue occurs when copying `media name` and `if name` to `name parts`, which may overwrite the destination. This is due to the use of `strcpy()` with insufficient buffer size checks, as reported by Smatch. The vulnerable code is located in `bearer.c` at lines 166 and 167, where `media name` and `if name` are too large for `name parts->media name` and `name parts->if name`, respectively. The vulnerability was introduced by commit `b97bf3fd8f6a` ("[TIPC] Initial merge"). Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the vulnerability. As a temporary workaround, consider using `strscpy()` instead of `strcpy()` and failing if truncation occurs to prevent buffer overruns. Restrict access to the vulnerable `bearer name validate()` function until the issue is resolved. Avoid using the `media name` and `if name` variables in the affected code paths until the update is applied.

The issue is related to a race condition in the Linux kernel's drm/lima component. This race condition can occur when a rendering job takes long enough to trigger the drm sched job timeout handler but still completes before the hard reset is done by the timeout handler. In some cases, this can result in a refcount imbalance on lima pm idle. The problem can be prevented by masking the irqs at the beginning of the timeout handler.

In CoCo VMs, it is possible for the untrusted host to cause `set memory encrypted()` or `set memory decrypted()` to fail, resulting in shared memory. Callers need to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The `netvsc` driver could free decrypted/shared pages if `set memory decrypted()` fails. Checking the `decrypted` field in the `gpadl` can decide whether to free the memory.

The issue is related to the Bluetooth L2CAP protocol in the Linux kernel, where user input is not properly validated for the setsockopt function. This could potentially lead to issues when copying data if the user input length is not checked beforehand.

The issue is related to an out-of-bounds access in the mmhub client id handling, specifically with cid 0x140. This has been resolved by properly handling the cid.

The issue is related to a functional regression in the Linux kernel's swiotlb component, which causes double-allocation of slots due to broken alignment handling. This can lead to buffer corruption and/or a hang when using vsock in a virtual machine with a restricted DMA SWIOTLB pool. The problem occurs because swiotlb alloc() expects a page-aligned allocation but returns a pointer to the 'struct page' corresponding to the allocation, resulting in double-allocation of the first half of the 4KiB page. The issue is resolved by treating the allocation alignment separately from any additional alignment requirements from the device.

The vulnerability is related to the NFS component of the Linux kernel. It is caused by incorrect locking in the `nfs netfs issue read()` function, which can lead to a deadlock when interrupts are not disabled while iterating through pages in the xarray to submit for NFS read. This issue can be reproduced with a specific test and may cause inconsistent lock state warnings on a lockdep-enabled kernel. The problem can occur when another page in the mapping is processed for writeback inside an interrupt, leading to a potential deadlock.

The issue is related to the I/O page fault handler in the Linux kernel, which currently locates the PCI device by calling `pci get domain bus and slot()`. This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, it is replaced with `device rbtree find()` to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after `device rbtree find()` and before `iopf get dev fault param()`, which would cause a use-after-free problem. A mutex is added to synchronize the I/O page fault reporting path and the IOMMU release device path.

The issue is related to the ubifs component of the Linux kernel, where page cache reads are lockless. This allows a simultaneous reader to see old data if the freshly allocated page is set uptodate before the new data is copied into it. The vulnerability can be exploited to cause a denial of service. The `SetPageUptodate` call has been moved to `ubifs write end()`, after the new data has been copied into the page, to resolve the issue. The functions `write begin slow()`, `ubifs write begin()`, and `ubifs write end()` in `fs/ubifs/file.c` are involved in the vulnerability.

The issue is related to the drm/amd/display component of the Linux kernel, where two problems have been fixed: a comparison with a wider integer type in a loop condition that can cause infinite loops, and a pointer dereference before a null check.

The issue is related to a null pointer dereference in the `ice ptp.c` file of the Linux kernel, specifically with the `devm kasprintf()` function, which can return a null pointer upon failure. This can potentially allow an attacker to cause a denial of service.