Zheyu Ma

A difficult to exploit vulnerability in Oracle VM VirtualBox allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data.

A null-pointer dereference issue has been resolved in the Linux kernel. The issue occurred because the driver did not check whether the client provided the platform data. Technical details about the issue include a null-pointer dereference in the kmemdup function, which is called by the lgdt3306a probe function. The vulnerability can be identified by a log message indicating a BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Recommendations: To resolve the issue, update to version 7.0.16 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

The issue is related to errors in resource release due to insufficient input validation in the Core component of Oracle VM VirtualBox. Exploitation of this issue can allow an attacker to cause a partial denial of service. The vulnerability can be easily exploited by a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes, potentially resulting in unauthorized ability to cause a partial denial of service of Oracle VM VirtualBox.

The issue is related to a buffer overflow in the lsi53c895a.c component of the QEMU hardware emulator. It may also involve a DMA-MMIO reentrancy problem, potentially leading to memory corruption bugs such as stack overflow or use-after-free. Exploitation of this issue could allow an attacker to cause a denial of service.

An out-of-bounds memory access flaw was found in the Linux kernel's Intel iSMT SMBus host controller driver. This issue arises when a user triggers the I2C SMBUS BLOCK DATA with malicious input data using the ioctl I2C SMBUS. The flaw allows a local user to crash the system. The vulnerability is related to the incorrect calculation of the buffer size in the `ismt access()` function when processing the I2C SMBUS BLOCK DATA block data record.

The issue is related to an out of bounds memory access in the `smtcfb read()` function, which could allow an attacker to disclose protected information and cause a denial of service. Local attackers may be able to crash the kernel by exploiting this issue. The vulnerability is associated with the `drivers/video/fbdev/sm712fb.c` file.

A buffer overflow issue was found in the Linux kernel's Intel iSMT SMBus host controller driver, specifically in how it handles the I2C SMBUS BLOCK PROC CALL case via the `I2C SMBUS` ioctl with malicious input data. This could allow a local user to crash the system, potentially leading to a denial of service.

تم إصلاح ثغرة أمنية في نواة Linux تتعلق بمكون RDMA/hfi1. تحدث المشكلة عند حدوث خطأ أثناء فحص hfi1 قبل تهيئة sdma map lock، مما يؤدي إلى محاولة الدالة hfi1 free devdata() استخدام قفل لم يتم تهيئته. قد يؤدي ذلك إلى ظهور رسالة INFO وتتبع المكدس. ترتبط هذه الثغرة الأمنية باستخدام sdma map lock في الدالة sdma clean()، التي تُستخدم لتحرير ذاكرة sdma map. يمكن تجنب المشكلة بالتحقق من أن sdma map ليست NULL قبل محاولة استخدام القفل.

تم اكتشاف خطأ في نواة لينكس، وتحديدًا في برنامج التشغيل cx23885. تحدث المشكلة عندما يفشل برنامج التشغيل في استدعاء الدالة `dma set mask()`، مما يؤدي إلى حدوث خطأ «use-after-free». يحدث هذا الخطأ لأن برنامج التشغيل يقوم بتهيئة الموارد المتعلقة بـ i2c في `cx23885 dev setup()`، لكنه يفشل في تحريرها أثناء معالجة الأخطاء. يظهر الخطأ بوضوح في سجل نواة لينكس، حيث تظهر رسالة BUG: KASAN: use-after-free.

تم تحديد مشكلة تتعلق بإشارة مؤشر فارغ في الدالة `slgt clean()` في برنامج التشغيل synclink gt. يحدث هذا عندما يفشل برنامج التشغيل في `alloc hdlcdev()` ويتم إزالة وحدة برنامج التشغيل بعد ذلك، مما يؤدي إلى حدوث خطأ عام في الحماية. تنجم المشكلة عن عدم التحقق مما إذا كان `info->netdev` مؤشرًا فارغًا قبل استخدامه.

The issue is related to the i740 driver in the Linux Kernel, where a Userspace program can pass any values to the driver through the ioctl() interface. The driver does not check the value of `pixclock`, which may cause a divide by zero error. This could potentially allow an attacker to cause a denial of service.

The vulnerability is related to a null pointer dereference in the `com20020pci probe()` function during driver initialization. The issue arises because the `com20020pci id table` definition reveals that the `ci` field is empty for some devices, causing a null pointer dereference when initializing these devices. This can lead to a denial of service. The vulnerability affects all versions of the Linux kernel prior to the fix.

تم تحديد مشكلة توقف في نواة لينكس، وتحديدًا في برنامج التشغيل sm712fb عند الكتابة في ذاكرة الإطار (framebuffer). يتوقف برنامج التشغيل عند محاولة كتابة ثلاثة بايتات، مما يؤدي إلى حدوث خطأ «فشل الصفحة» (page fault). ترتبط المشكلة بالدالة `smtcfb write()` ويمكن تشغيلها عبر الدالتين `vfs write()` و`ksys write()`. يتميز الخطأ برسالة BUG تشير إلى عدم القدرة على معالجة خطأ صفحة لعنوان محدد، يتبعها تتبع استدعاء (call trace).

The vulnerability is related to a double free issue in the `igbvf probe` function. When `register netdev` fails, the program goes to the `err hw init` label and then to the `err ioremap` label. In `free netdev`, there is a `list for each entry safe` and `netif napi del` which aims to delete all entries in `dev->napi list`. However, `adapter->rx ring` has been freed below the `err hw init` label, causing a use-after-free (UAF) issue. The KASAN logs indicate a use-after-free in `free netdev+0x1fd/0x450`. To patch the problem, one can refer to `igbvf remove` and delete the entry before `adapter->rx ring`.

The issue is related to a use-after-free (UAF) vulnerability in the Linux kernel, specifically in the `peak pci remove()` function. When the `peek pci` module is removed, referencing the `chan` variable again after releasing the `dev` variable can cause a UAF. The vulnerability is fixed by releasing the `dev` variable later. Technical details about the exploitation include the `peak pci remove()` function and the `chan` and `dev` variables.

The Linux kernel has a vulnerability where the driver can call the `card->isac.release()` function from an atomic context. This issue is fixed by calling the function after releasing the lock. The vulnerability is related to a sleeping function being called from an invalid context. Technical details about exploitation include: - The `card->isac.release()` function is called from an atomic context. - The `nj release()` function is involved in the call trace. - The issue is related to the `mISDN freedchannel()` and `isac release()` functions.

The vulnerability is related to the use of 'request firmware nowait' instead of 'request firmware' in the 'rp2 probe' function. This can cause a NULL pointer dereference or other bugs when an interrupt occurs and the interrupt handler function 'rp2 uart interrupt' accesses uninitialized ports of 'rp2 card'. The issue arises because the driver does some initialization work in 'rp2 fw cb', which is called through 'request firmware nowait', and if the firmware does not exist, the function returns without initializing the ports. To fix this, 'request firmware' should be used instead of 'request firmware nowait' to ensure the driver is ready to handle interrupts.

A vulnerability in the Linux kernel has been resolved, specifically in the isdn: mISDN: netjet module. The issue arises when 'nj setup' in netjet.c fails with -EIO, causing 'card->irq' to be initialized with a value greater than zero. A subsequent call to 'nj release' will then attempt to free the irq that was not requested, leading to a crash. The KASAN log reveals this issue. The vulnerability is related to the use of the `free irq` function and the `nj release` function.

A flaw was found in the Nosy driver in the Linux kernel, allowing a device to be inserted twice into a doubly-linked list. This leads to a use-after-free when one of these devices is removed, posing a threat to confidentiality, integrity, and system availability.