Dann Frazier

The Ubuntu edk2 UEFI firmware packages unintentionally permitted access to the UEFI Shell within Secure Boot environments, potentially circumventing Secure Boot protections. Earlier versions included a secure-boot-based mechanism to maintain operation within the Shell, which is considered adequate for enforcing Secure Boot restrictions. This issue represents an additional correction related to a previous incomplete fix.

The issue is triggered by a DDoS attack on tcp port 22, causing a kernel crash. This problem arises from the backport of a commit related to `nft lookup` without including subsequent fixes.

The issue is related to the GTDT driver in the Linux kernel. When the driver probe fails due to invalid firmware properties, it unmaps the interrupt that it mapped earlier. However, it does not check whether the mapping of the interrupt actually succeeded. If the firmware reports an illegal interrupt number that overlaps with the GIC SGI range, this can result in an IPI being unmapped, leading to subsequent issues. The driver has been reworked to have a saner behavior and actually check whether the interrupt has been mapped before unmapping things.

The issue is related to an untrusted search path vulnerability. It allows local users to execute arbitrary code via a Trojan horse `import pxe files` configuration file in the current working directory.

The issue allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames. This is achieved by sending one frame that omits an SSID Information Element (IE) and a subsequent frame that contains an SSID IE, which triggers a NULL pointer dereference in the `cmp ies` function.

The issue allows local users to cause a denial of service, resulting in a "soft lockup" and process loss. This occurs when a large number of `sendmsg` function calls are made, which does not block during AF UNIX garbage collection and triggers an OOM condition.

The issue is related to multiple vulnerabilities in the Linux kernel, specifically in the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely, leading to a disruption of protected information. The exploitation can be carried out through various means, including the TSB I-TLB load implementation in arch/sparc/kernel/tsb.S, which does not properly obtain the value of a certain PAGE EXEC 4U bit, making it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application.