Hazley Samsudin

The `xfs admin` utility fails to properly validate user-supplied parameters, which enables operating system command injection. A local attacker can exploit this by providing crafted input arguments, potentially leading to arbitrary command execution and local privilege escalation, especially when the tool is run with root privileges via sudo delegation or provisioning tools.

A race condition exists in the sound(4) driver when resizing an audio channel buffer. The driver verifies that the buffer is not memory-mapped and releases the channel lock to allocate a new buffer. If an `mmap(2)` call occurs on another thread during this interval, the resize process may free the buffer while it is still mapped. This can allow an unprivileged local user with sound device access to trigger a use-after-free condition in the kernel, which may lead to privilege escalation.

A change in the kernel structure for user credentials caused the `group is primary()` function to be improperly updated. This function is utilized by `mac do` to determine the primary group ID of a credential after applying a transition rule when the target does not explicitly specify a group. Consequently, specific `mac do` rules can be abused to incorrectly set the primary group ID to the value stored in the first element of the original credential's supplementary group array. If the supplementary group list is empty, the primary group ID may be set to 0 (the wheel group), potentially allowing for privilege escalation to root depending on the system configuration. To trigger this, the rule must apply to the caller, and the process must typically remove all supplementary groups using the `setgroups(2)` system call.

A use-after-free issue exists in the implementation of an ioctl, which occurs when the system attempts to acquire locks on all channels in a sync group. If locking a channel blocks, the system releases the sync group list lock and sleeps; however, it fails to handle cases where the sync group structure is freed before the system reawakens. On systems with multiple audio devices, an unprivileged local user can exploit this to escalate privileges.

A use-after-free issue exists in the kernel during the copying of knotes during a fork operation. A knote with a timer-based filter may fire and be enqueued on the kqueue active list before the copy process completes. Because the copy routine fails to account for this and does not hold appropriate locks while reading knote state, the new knote could be enqueued a second time, leading to active list corruption and race conditions. An unprivileged local user can exploit this to potentially achieve privilege escalation.

An unprivileged local user can obtain uninitialized kernel stack memory, potentially disclosing sensitive kernel data. This occurs when creating a POSIX timer with CLOCK TAI and calling the `timer settime(2)` function. The issue stems from the kernel calling `realtimer gettime()` to retrieve the previous timer value; if no TAI offset is configured, the function fails, but because the error return is not checked, the uninitialized output buffer is copied to userspace.

An integer overflow occurs in the `dsp mmap single()` function when validating requested mappings by summing a user-supplied offset and length against the buffer size. A large offset and length can wrap around, bypassing the check. Subsequently, the offset is narrowed from 64 to 32 bits during conversion to a buffer address, creating a mapping that extends beyond the audio buffer into unrelated kernel memory. Because `/dev/dsp` device nodes are world-accessible by default, an unprivileged local user can read and write kernel memory. This can lead to privilege escalation, full system control, or a Denial of Service (DoS) by crashing the kernel.

A format string injection exists in the Find Results panel handler. This occurs when the application processes a maliciously crafted `nativeLang.xml` language pack file. An attacker can distribute a poisoned language pack through community channels; when a user performs search operations, the application triggers format string interpretation. This can lead to access violations, denial of service, and the potential leakage of stack or register contents (information disclosure).

A string injection issue exists in the FindInFiles search function due to flaws in the formatting string processing mechanism. Successful exploitation could allow an attacker to obtain sensitive memory address information or cause the application to crash (denial of service) by using a specially crafted file. This risk is particularly relevant for users utilizing custom `nativeLang.xml` localization files.