Al Viro

The issue is related to the Linux kernel, specifically the xen: privcmd component. It allows for possible access to a freed kirqfd instance due to simultaneous ioctl calls to `privcmd irqfd assign()` and `privcmd irqfd deassign()`. If this happens, a kirqfd created by `privcmd irqfd assign()` may be removed by another thread executing `privcmd irqfd deassign()` while still being used, leading to a situation where an already freed kirqfd instance may be accessed and cause kernel oops. The fix involves using SRCU locking, similar to the KVM implementation for irqfds.

The issue is related to a deadlock that occurs when `irqfd wakeup()` gets `EPOLLHUP` and is called by `eventfd release()` through `wake up poll(&ctx->wqh, EPOLLHUP)`, which is called under `spin lock irqsave()`. This happens because a mutex cannot be used in this context, as it would lead to a deadlock. The fix involves switching from a mutex to a spinlock for irqfds. The vulnerability can be exploited through a local network attack vector.

A use-after-free vulnerability in the `kvm spapr tce attach iommu group()` function in the Linux kernel allows an attacker to potentially impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when the function looks up `stt` from `tablefd` and continues to use it after doing `fdput()` on the returned fd, which can be closed by another thread, freeing `stt`. Although there are calls to `rcu read lock()` in `kvm spapr tce attach iommu group()`, they are not sufficient to prevent the use-after-free, as `stt` is used outside the locked regions. The issue can be detected by KASAN with an artificial delay after the `fdput()` and a userspace program that triggers the race.

The issue is related to a use-after-free vulnerability in the Linux kernel's IMA (Integrity Measurement Architecture) component, specifically in the `ima collect measurement()` function. This vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs because the `d name.name` field of a `dentry` can change when renamed, and the earlier value can be freed. However, the conditions to stabilize this, such as `d lock` on the `dentry`, its parent, or `i rwsem` exclusive on the parent's inode, and `rename lock`, are not met at the affected sites. To resolve this, a stable snapshot of the name is taken instead.

The issue is related to the Linux kernel, specifically with the `do dup2()` function, where a misprediction might lead to speculative execution of `tofree = fdt->fd[fd]`. This is wrong for the same reasons it is wrong in `close fd()`/`file close fd locked()`. The solution involves using `array index nospec(fd, fdt->max fds)` to protect against mispredictions. The vulnerability is associated with incorrect input validation in the `fs/file` component of the Linux kernel, which could allow an attacker to cause a denial of service.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a deadlock or deadcode in the Linux kernel's ceph component, caused by incorrect lock ordering between denty and its parent. The lock order is incorrect, and the parent should always get the lock first. However, since this deadcode is never used and the parent directory will always be set from the callers, the solution is to remove it. The vulnerability may allow an attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue exists in the `f2fs rename()` function of the f2fs component. The flaw occurs during cross-directory renames when the system fails to call `f2fs set link()` to update the `..` link to the new directory, particularly when a whiteout is requested. This can lead to dirent corruption, where the inode number for the parent directory is incorrect. Exploitation of this issue may allow an attacker to elevate privileges.

The issue is related to a race condition in the Linux kernel, specifically in the enable sacf uaccess function, which can lead to code execution. This occurs because the function fails to protect against a concurrent page table upgrade. A crash could also occur as a result of this issue. The problem is associated with errors in executing multithreaded tasks.

The issue is related to a use-after-free in the `fs/namei.c` file of the Linux kernel. This can be exploited by local users to cause a denial of service or possibly obtain sensitive information from kernel memory. One potential attack vector involves an open system call for a UNIX domain socket, specifically when the socket is being moved to a new parent directory and its old parent directory is being removed.

Name of the Vulnerable Software and Affected Versions: Android kernel Description: There is an elevation of privilege issue in the bluez component of the Upstream kernel. This affects the Android product. Recommendations: For Android kernel, apply the necessary patches or updates to resolve the elevation of privilege issue in the bluez component.

The issue is related to the bnep add connection function in the Linux kernel, which does not properly check for the availability of an l2cap socket. This allows local users to potentially gain privileges by using a crafted application.

The issue is related to the d walk function in fs/dcache.c, which does not properly maintain the semantics of rename lock. This allows local users to cause a denial of service, resulting in a deadlock and system hang, via a crafted application.

The issue is related to the cifs iovec write function in fs/cifs/file.c, which does not properly handle uncached write operations that copy fewer than the requested number of bytes. This allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

The issue is related to the inotify functionality in the Linux kernel, which might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.

The issue is related to the fill write buffer function in sysfs/file.c, which does not properly zero-terminate a buffer when a length of PAGE SIZE or more is requested. This could allow local users to cause a denial of service by triggering an out-of-bounds read, potentially leading to a system crash.

The issue concerns multiple unknown vulnerabilities in the Linux kernel and the aa-sources package in Gentoo Linux. These vulnerabilities can be exploited locally to gain privileges, access kernel memory, or disrupt the confidentiality, integrity, and availability of protected information.

The issue involves multiple vulnerabilities that can be exploited remotely, potentially leading to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities may cause a denial of service or allow the execution of arbitrary code via maths overflow errors, including integer signedness errors or integer overflows that lead to buffer overflows.

The issue involves multiple vulnerabilities in the usbvision-kmp packages of the openSUSE operating system, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. Additionally, a function in the Linux kernel, specifically the `isdn ppp ccp reset alloc state` function in `drivers/isdn/isdn ppp.c`, has an unknown attack vector that can cause a system crash due to not calling the `init timer` function for the ISDN PPP CCP reset state timer.

The issue affects the Linux kernel and SUSE Linux Enterprise, involving multiple vulnerabilities in various packages. These vulnerabilities can be exploited locally, potentially leading to disruptions in confidentiality, integrity, and availability of protected information. The raw sendmsg function in the Linux kernel is specifically mentioned as allowing local users to cause a denial of service or read from arbitrary memory via crafted input.

The issue is related to multiple vulnerabilities in various Linux kernel packages and modules, which can lead to a denial of service (crash) and potentially allow remote attackers to execute arbitrary code. The vulnerabilities can be exploited remotely. The affected packages include kernel-image, kernel-headers, pcmcia-modules, hostap-modules, and others. The vulnerabilities are related to buffer overflows in the cmtp recv interopmsg function in the Bluetooth driver.