Brad Spengler

Nome do Software Vulnerável e Versões Afetadas: Kernel Linux (versões afetadas não especificadas) Descrição: Uma vulnerabilidade no kernel Linux foi resolvida, relacionada à função gtp net exit batch rtnl(). O problema foi relatado por Brad Spengler e é causado pelo potencial de corrupção splat em list del() na gtp net exit batch rtnl(). Isso pode ocorrer quando o loop for each netdev() em gtp net exit batch rtnl() destrói dispositivos em cada netns, levando a ->dellink() ser chamado duas vezes para o mesmo dispositivo durante ->exit batch rtnl(). Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

Nome do software vulnerável e versões afetadas: Kernel do Linux (versões afetadas não especificadas) Descrição: O problema ocorre ao copiar um namespace no kernel do Linux. Especificamente, a nova cópia não é adicionada à árvore rbtree do namespace até que a operação de cópia tenha sido concluída com sucesso. No entanto, quando a função `free mnt ns()` é chamada, ela tenta remover a cópia da árvore rbtree, o que constitui uma operação inválida. Para resolver isso, o esqueleto do namespace é liberado diretamente. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

O kernel Linux apresenta uma vulnerabilidade no módulo tracefs, na qual o uso do RCU genérico de inodes para sincronizar a liberação de memória pode causar uma corrupção na lista list del ao executar os autotestes do ftrace. Isso pode resultar em um erro BUG no kernel e em um erro de código de operação inválido. A vulnerabilidade é causada pela sobreposição de membros usados pelo RCU ou inicializados apenas uma vez na estrutura inode, como i lru ou i sb list, quando a randomização do layout da estrutura está habilitada.

A vulnerabilidade está relacionada à chamada paravirt x86/xen no kernel do Linux. Especificamente, a chamada `USERGS SYSRET64` é usada para retornar de uma chamada de sistema via `SYSRET`, mas um convidado Xen PV usará a hipochamada `IRET` em vez disso, pois não há nenhuma hipochamada PV `sysret` definida. Para resolver isso, a chamada `USERGS SYSRET64` é removida, e a saída `IRET` é usada desde o início. Essa alteração simplifica o código e permite que `CLEAR CPU BUFFERS` seja explicitamente adicionado ao caminho `syscall return via sysret`.

The issue is caused by incorrect interaction with the `CONFIG VMAP STACK` option in the Linux kernel, allowing local users to cause a denial of service, such as a system crash or memory corruption, by leveraging the use of more than one virtual page for a DMA scatterlist. This is due to a buffer overflow in memory.

The issue is caused by a buffer overflow in the `drivers/media/usb/dvb-usb/cxusb.c` driver of the Linux kernel. It can be exploited by a local attacker who interacts incorrectly with the `CONFIG VMAP STACK` parameter, potentially causing a denial of service, such as a system crash, or possibly other unspecified impacts. This is achieved by leveraging the use of more than one virtual page for a DMA scatterlist.

The issue is related to the mm subsystem in the Linux kernel, which does not properly enforce the CONFIG STRICT DEVMEM protection mechanism. This allows local users to read or write to kernel memory locations in the first megabyte, bypassing slab-allocation access restrictions, by opening the /dev/mem file. The affected files are arch/x86/mm/init.c and drivers/char/mem.c.

The issue is caused by incorrect interaction with the `CONFIG VMAP STACK` option in the Linux kernel, allowing local users to cause a denial of service, such as a system crash or memory corruption, by leveraging the use of more than one virtual page for a DMA scatterlist. This is due to a buffer overflow in memory.

The issue is caused by a buffer overflow in the Linux kernel's drivers/net/usb/catc.c driver. It allows a local attacker to cause a denial of service, such as a system crash or memory corruption, by interacting incorrectly with the `CONFIG VMAP STACK` parameter and using more than one virtual page for a DMA scatterlist.

The issue is related to errors in implementing protections against Spectre class vulnerabilities in the Linux kernel's ptrace subsystem. Exploitation of this issue may allow an attacker to disclose protected information. A backporting error in the Linux stable/longterm kernel reintroduced a Spectre vulnerability that was supposed to be eliminated. This occurred due to the misuse of an upstream commit and the swapping of two correctly ordered code lines.

The issue is related to a lack of error checking in the `do video set spu palette` function, which could potentially allow local users to access sensitive information from kernel stack memory. This can be achieved through a crafted `VIDEO SET SPU PALETTE` ioctl call on a `/dev/dvb` device.

The issue exists due to the lack of initialization of certain structures in the net/xfrm/xfrm user.c file of the Linux kernel. This allows local users with the CAP NET ADMIN capability to obtain sensitive information from kernel memory.

The issue concerns multiple vulnerabilities in the Linux operating system, specifically in the Debian GNU/Linux package, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. A heap-based buffer overflow vulnerability exists in the `tg3 read vpd` function in the Linux kernel, allowing physically proximate attackers to cause a denial of service or possibly execute arbitrary code via crafted firmware.

The issue concerns a function in the Linux kernel that does not perform an expected uid check, making it easier for local users to defeat the ASLR protection mechanism. This can be done by reading specific fields in the /proc/#####/stat file for a process executing a PIE binary. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise that can lead to disruption of protected information and can be exploited remotely.

The issue allows local users to cause a denial of service due to memory consumption via a crafted exec system call. This is related to the handling of stack memory by arrays representing arguments and environment variables in the fs/exec.c file.

The issue is related to the setup arg pages function in fs/exec.c, which does not properly restrict stack memory consumption for 32-bit applications on 64-bit platforms when CONFIG STACK GROWSDOWN is used. This allows local users to cause a denial of service, resulting in a system crash, via a crafted exec system call.

The issue allows local users to obtain potentially sensitive information from kernel heap memory due to an off-by-one error in the `ioctl standard iw point` function. This can be achieved via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size. Multiple vulnerabilities in the cpint-kmp-default, cloop-kmp-default, and drbd-kmp-default packages of the SUSE Linux Enterprise and openSUSE operating systems can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally.