Jann Horn

A time-of-check to time-of-use (TOCTOU) race condition exists in the dynamic loader (ld.so). This occurs when expanding `$ORIGIN` in `DT RPATH` for setuid/setgid (AT SECURE) programs; the system validates the lexically normalized search path against trusted directories but subsequently opens the raw, un-normalized path. On systems where the Linux `fs.protected hardlinks` sysctl is disabled, a local attacker can hard-link a program into a controlled directory and replace an intermediate path component with a symbolic link. This allows the loader to be directed outside the trusted directory to load an attacker-controlled shared object, leading to arbitrary code execution with elevated privileges. Exploitation requires a setuid or setgid binary whose `DT RPATH` uses `$ORIGIN` followed by ".." traversal that normalizes into a trusted directory.

A reflected Cross-Site Scripting (XSS) issue allows an attacker to inject malicious scripts into a web page. This could lead to arbitrary code execution within the context of the current user. Successful exploitation requires user interaction, specifically that the victim opens a malicious link.

An Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows a security feature bypass. This issue enables an attacker to obtain limited read and write access to unauthorized files or directories located outside of the intended restrictions without requiring user interaction.

An out-of-bounds write issue exists where memory is written outside the intended boundary of a buffer. This could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically the opening of a malicious file.

Improper Input Validation allows for arbitrary code execution in the context of the current user. This issue can be exploited without requiring any user interaction.

Memory corruption occurs when processing display command line information. This issue is caused by the improper initialization of a variable.

A NULL dereference can occur in the USB-audio driver's Scarlett2 mixer quirk when processing a malformed USB descriptor. This happens because the `scarlett2 find fc interface()` function assumes an endpoint exists in the parsed interface without verification.

Improper Input Validation allows arbitrary file system read, which could enable an attacker to access sensitive files or data on the system. Exploitation requires user interaction, specifically that a victim opens a malicious file.

An Untrusted Search Path issue exists where the application uses a search path to locate critical resources such as programs. An attacker could modify this search path to point to a malicious program, which the application would then execute, potentially allowing arbitrary code execution in the context of the current user. This exploitation does not require user interaction.

An Access of Uninitialized Pointer issue exists, which could lead to memory exposure. This allows an attacker to disclose sensitive information, provided the victim opens a malicious file.

An out-of-bounds read occurs when parsing a crafted file, which can lead to a read past the end of an allocated memory structure. This issue allows an attacker to execute code within the context of the current user, provided the victim opens a malicious file.

An Uncontrolled Resource Consumption issue could lead to application denial-of-service. A high-privileged attacker can exhaust system resources, which reduces application speed. This exploitation does not require user interaction.

An out-of-bounds read occurs when parsing a crafted file, which can lead to a read past the end of an allocated memory structure. This issue allows an attacker to execute code within the context of the current user, provided the victim opens a malicious file.

An out-of-bounds write issue exists where the software writes data past the end of the intended buffer, which could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically requiring a victim to open a malicious file.

An issue involving Deserialization of Untrusted Data allows for arbitrary code execution in the context of the current user. This flaw can be exploited without requiring any user interaction and results in a change of scope.

An out-of-bounds write issue exists where an attacker can corrupt memory, potentially leading to an application denial-of-service, causing the application to crash or become unresponsive. Exploitation requires user interaction, specifically requiring a victim to open a malicious file.

A Heap-based Buffer Overflow (a condition where a program writes more data to a heap-allocated memory block than it can hold) could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically the opening of a malicious file.

An out-of-bounds write occurs when a program writes data past the end of the intended buffer. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically the opening of a malicious file.

A reflected Cross-Site Scripting (XSS) issue exists where an attacker can convince a victim to visit a URL referencing a vulnerable page. This allows malicious JavaScript content to be executed within the context of the victim's browser. This issue involves a change in scope.

A Heap-based Buffer Overflow occurs when a program writes more data to a heap-allocated memory block than it can hold. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically the opening of a malicious file.