Xingyuan Mo

A null pointer dereference issue was found in the `ath10k wmi tlv op pull mgmt tx compl ev()` function in the drivers/net/wireless/ath/ath10k/wmi-tlv.c module of the Linux kernel. This issue could be exploited to trigger a denial of service.

A use-after-free vulnerability in the Linux kernel's netfilter: nf tables component can be exploited to achieve local privilege escalation. The function `nft pipapo walk` did not skip inactive elements during set walk, which could lead to double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. This issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information and elevate their privileges in the system.

A null pointer dereference issue was found in the `nft dynset init()` function in `net/netfilter/nft dynset.c` in `nf tables` in the Linux kernel. This issue may allow a local attacker with `CAP NET ADMIN` user privilege to trigger a denial of service.

The issue is related to a null pointer dereference flaw in the nft inner.c functionality of netfilter in the Linux kernel. This flaw could allow a local user to crash the system or escalate their privileges on the system.

The issue is related to the `sec attest info` function in the Linux kernel, which allows an information leak to user space because `info->pad0` is not initialized. This can potentially allow an attacker to gain unauthorized access to protected information.

The issue is related to a use-after-free in the `iopt unmap iova range()` function in the `drivers/iommu/iommufd/io pagetable.c` module of the Linux kernel. This could allow an attacker to cause a denial of service by exploiting the use of previously freed memory.

The issue is related to the use of memory after it has been freed in the set con2fb map() function in the Linux kernel. This can lead to a denial of service. The problem arises because an assignment occurs only for the first vc, causing the fbcon registered fb and fbcon display arrays to become desynchronized in fbcon mode deleted, as the con2fb map points to the old fb info.

A flaw was found in KVM that could cause an information leak when calling the KVM GET DEBUGREGS ioctl on 32-bit systems. This issue is related to uninitialized portions of the kvm debugregs structure being copied to userspace. The vulnerability is associated with errors in initializing variables in the kvm vcpu ioctl x86 get debugregs() function of the KVM subsystem in the Linux kernel.

A vulnerability was found due to a missing lock for the IOPOLL flaw in the `io cqring event overflow()` function in `io uring.c`. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat. The vulnerability is related to incorrect resource locking, which may also allow an attacker to elevate privileges.

The issue is related to a use-after-free flaw in the NFS filesystem in the Linux Kernel, specifically in the `nfsd4 ssc setup dul` function in `fs/nfsd/nfs4proc.c`. This flaw could allow a local attacker to crash the system or lead to a kernel information leak problem. The vulnerability is associated with the repeated use of previously freed memory.

O problema está relacionado a uma vulnerabilidade do tipo “use-after-free” no driver do sistema de arquivos NFS do kernel do Linux. Essa falha permite que um invasor remoto provoque uma negação de serviço. A vulnerabilidade foi identificada especificamente na função ` nfs42 ssc open()` em `fs/nfs/nfs4file.c`.

O problema está relacionado à função `stex queuecommand lck()` no kernel Linux, que está associada à divulgação de informações em uma área de dados de erro. Isso pode permitir que um invasor obtenha acesso não autorizado a informações protegidas. O problema surge porque `stex queuecommand lck` não possui um `memset` para o caso `PASSTHRU CMD`, permitindo que usuários locais obtenham informações confidenciais da memória do kernel.

O problema está relacionado a um uso após liberação (use-after-free) na função `io sqpoll wait sq` em `fs/io uring.c`, o que permite que um invasor cause uma falha no kernel, resultando em negação de serviço. A função `finish wait` pode ser ignorada. Um ataque pode ocorrer em algumas situações ao bifurcar um processo e, em seguida, encerrá-lo rapidamente.