Dmitry Vyukov

Abseil-cpp contains a heap buffer overflow issue. The `sized constructors`, `reserve()`, and `rehash()` methods of `absl::{flat,node}hash{set,map}` did not enforce a limit on the size of their input argument. This allowed a malicious actor to provide a large size, causing an integer overflow when calculating the container's backing store size, leading to an out-of-bounds memory write. Subsequent access to the container could also result in out-of-bounds memory access. The issue could potentially allow an attacker to cause a denial of service or memory corruption.

A use-after-free issue has been identified in the Linux kernel, specifically in the btrfs file system. This occurs when attempting to join an aborted transaction, where the 'aborted' field is read after unlocking fs info->trans lock and without holding any extra reference count on it. This allows a concurrent task that is aborting the transaction to free the transaction before the 'aborted' field is read, resulting in a use-after-free. The issue was reported by syzbot and Dmitry, with stack traces provided from KASAN.

A vulnerability in the Linux kernel has been identified, related to an out-of-bounds read during lookup in the xfrm state. The issue arises when lookup and resize operations run in parallel, and the hash functions can observe a hmask value that is too large for the new hlist array. This is due to the xfrm state hash generation seqlock ensuring a retry, but not preventing the hash functions from accessing an inconsistent hmask value. The vulnerability can be exploited when the update to state bydst is not properly synchronized with the lookup function.

A use-after-free flaw was found in `qdisc graft` in `net/sched/sch api.c` in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. The issue can be exploited to cause a denial of service.

The issue is related to a null pointer dereference in the tipc component of the Linux kernel. Specifically, the function `tipc aead init()` is vulnerable, and exploitation can lead to a denial of service. The problem arises because `kmemdup` can return a null pointer, which is not checked, resulting in a null key being dereferenced later in `tipc crypto key xmit`.

The issue is related to the handling of the hrtimer in the mac80211-hwsim module. When the timer fires late due to vCPU scheduling, it attempts to rearm the timer at the next deadline, which may be in the past. This behavior is incorrect and can cause stalls. The correct approach is to align the beacons to the TBTT (Target Beacon Transmission Time) and resume at the current point if late. The code has been changed to use `hrtimer forward now()` to ensure the next firing of the timer is at the next interval point after the current time.

The issue allows attackers to obtain potentially sensitive information from kernel memory. This is related to a write mmio stack-based out-of-bounds read in the KVM implementation, specifically in the files arch/x86/kvm/x86.c and include/trace/events/kvm.h.

The issue concerns the x86/fpu subsystem in the Linux kernel, which does not correctly handle attempts to set reserved bits in the xstate header via the `ptrace()` or `rt sigreturn()` system call when a processor supports the xsave feature but not the xsaves feature. This allows local users to read the FPU registers of other processes on the system.

The issue is related to a NULL pointer dereference in the Linux kernel, specifically in the net/ipv4/route.c file. This allows local users to cause a denial of service or possibly have other unspecified impacts via crafted system calls. The problem is associated with errors in pointer handling.

A race condition exists in the Linux kernel, allowing local users to cause a denial of service, such as a system crash, via crafted system calls. This issue is related to incorrect interaction between `put ucounts` and `get ucounts` due to certain decrement behavior.

The issue is related to the improper management of lock dropping by the `hashbin delete` function in the Linux kernel, which can be exploited by local users to cause a denial of service (deadlock) through crafted operations on IrDA devices.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and soft lockup. This can be achieved via vectors involving a TCP packet with the URG flag. The `tcp splice read` function in `net/ipv4/tcp.c` is the vulnerable component.

The issue is related to errors in resource management in the `nested vmx check vmptr` function of the Linux operating system. This can be exploited by a local attacker to cause a denial of service, specifically through memory consumption. The `nested vmx check vmptr` function in the Linux kernel improperly emulates the VMXON instruction, allowing KVM L1 guest OS users to cause a denial of service by leveraging the mishandling of page references.

The issue allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt.

The issue is related to the netfilter subsystem in the Linux kernel, which mishandles IPv6 reassembly. This can be exploited by local users via a crafted application that makes socket, connect, and writev system calls, potentially leading to a denial of service (integer overflow, out-of-bounds write, and GPF) or other unspecified impacts.

The issue allows guest OS users to gain host OS privileges or cause a denial of service, resulting in an out-of-bounds array access and host OS crash, via a crafted interrupt request when I/O APIC is enabled. This is related to the files arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.

The issue allows local users to obtain sensitive information from kernel stack memory via a crafted application due to improper initialization of Code Segment (CS) in certain error cases.

A race condition exists in the get task ioprio function, allowing local users to potentially gain privileges or cause a denial of service through a crafted ioprio get system call. This issue can lead to a use-after-free scenario.

The issue is related to a use-after-free vulnerability in the ` sys recvmmsg` function, located in the net/socket.c file of the Linux kernel. This vulnerability can be exploited by remote attackers to execute arbitrary code through vectors involving a recvmmsg system call that is mishandled during error processing.

The issue allows local users to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This occurs when a crafted application does not supply a key, related to the `lrw crypt` function.