Mathias Payer

O problema consiste em um estouro de buffer baseado na pilha (heap) na função `mrb yield with class`, localizada no arquivo vm.c, devido a um tratamento incorreto da pilha da VM. Isso pode ser desencadeado por meio da função `stack copy`.

The issue is related to a Double Free error in the Linux kernel, specifically in the drivers/net/wireless/rsi/rsi 91x usb.c file. This error can be triggered by crafted USB device traffic, which may be remote via usbip or usbredir, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to the `check input term` function in the `sound/usb/mixer.c` file of the Linux kernel, which mishandles recursion. This leads to kernel stack exhaustion.

The issue is related to the `parse audio mixer unit` function in the `sound/usb/mixer.c` file of the Linux kernel, which mishandles a short descriptor, leading to out-of-bounds memory access. This can potentially allow an attacker to access confidential information or cause a denial of service.

The issue is related to a buffer overflow in the apply.cgi file, which can be exploited by crafting a POST request payload with authentication. This allows attackers to hijack the control flow to any location specified by the attacker.

The issue allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication. This is due to a buffer overflow in the video.cgi component.

The issue allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication. This is due to a buffer overflow in the network.cgi.

The issue allows remote attackers to execute arbitrary commands on the device. This is achieved by exploiting an OS command injection vulnerability in the start arpping function of the timer binary. The vulnerability can be triggered by passing malicious input to the `dhcpd start`, `dhcpd end`, and `lan ipaddr` parameters in a POST request to the "apply.cgi" binary.

The issue is related to the function `hso get config data` in the Linux kernel, which reads data from a USB device and uses it to index an array. This can result in an object out-of-bounds read, potentially allowing arbitrary read access in the kernel address space. The vulnerability may be exploited to cause a denial of service.

The issue is related to a use-after-free in the ALSA driver. A local user could exploit this by supplying a malicious USB Sound device that is mishandled in the `usb audio probe` function in `sound/usb/card.c`. This could allow an attacker to execute arbitrary code or cause a denial of service.

An issue in the Linux kernel's USB subsystem mishandles size checks during the reading of an extra descriptor, related to the ` usb get extra descriptor` function in `drivers/usb/core/usb.c`. This issue may allow an attacker to impact the confidentiality and integrity of protected information.

The issue is related to the Kernel Samepage Merging (KSM) component in the Linux kernel, which does not prevent the use of a write-timing side channel. This allows guest OS users to defeat the Address Space Layout Randomization (ASLR) protection mechanism on other guest OS instances via a Cross-VM ASL Introspection (CAIN) attack. The vendor suggests disabling deduplication to mitigate this attack vector. This issue can be classified as a potentially misunderstood behavior rather than a vulnerability, as share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure.