Aaron Esau

A double-free issue exists in the `net/rds` module of the Linux kernel. The problem occurs when a zerocopy page pin operation fails within the `rds message zcopy from user()` function, specifically when `iov iter get pages2()` fails. In this scenario, while pinned pages are released and `rm->data.op mmp znotifier` is cleared, the memory management counter `op nents` is not correctly reset. Subsequently, when `rds sendmsg()` calls the `rds message purge()` function, the cleanup loop uses the incorrect non-zero value of `op nents` to release memory that has already been freed. A local attacker could exploit this to cause a system crash (denial of service), escalate privileges, or execute unauthorized code.

An unauthenticated stack-based buffer overflow vulnerability in common.c's handle PORT can be abused to cause a crash and could potentially lead to remote code execution.

The issue arises from improper implementation of a chroot jail in the `compose abspath` function in common.c, leading to multiple unauthenticated directory traversal vulnerabilities in different FTP commands. This can be exploited to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.

The issue allows an unauthenticated user to perform a directory traversal attack using multiple different FTP commands, enabling them to read and write to arbitrary locations on the filesystem. This is due to the lack of a well-written chroot jail in the `compose abspath()` function.

The issue is caused by a buffer overflow in the handle PORT function in ftpcmd.c. This occurs when a 16-byte buffer is filled with user input via sprintf() using the format specifier string %d.%d.%d.%d. Although the 16-byte size is sufficient for valid IPv4 addresses, the %d format specifier allows for more than 3 digits, leading to a potential overflow.