Jaeyeong Lee

A path handling issue exists in the `revisiond` component that allows an application already installed on the system to gain root privileges through local privilege escalation. The issue was caused by insufficient validation during path processing.

An out-of-bounds write issue exists where an application can write data past the end of a defined memory buffer. This can lead to kernel memory corruption or unexpected system termination.

A memory corruption issue exists in the legacy USB CDC virtual COM port driver. The problem occurs when `rx ringbuffer` is aliased as a Serial V2 `rt serial rx fifo` within the ` function enable()` function. A connected USB host configuring the CDC device can trigger writes that exceed the ring buffer, overwriting `struct vcom` members. This leads to an invalid `rt free()` call upon closing the connection, resulting in a denial of service.

The GetAsanaObject Processor in Apache NiFi utilizes a Distribute Map Cache Client Service for state management. This processor employs Java Object serialization and deserialization without adequate filtering, creating a potential for exploitation through crafted state information stored in the cache server. Successful exploitation requires access to the configured cache server and an Apache NiFi system running the GetAsanaObject Processor.