Kyle Zeng

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET CMD ADD and IPSET CMD SWAP can lead to a kernel panic due to the invocation of ` ip set put` on a wrong `set`. This issue may allow a local user to crash the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling ip options compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP NET ADMIN privileges to crash the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system, specifically in how a user restores an XFS image after failure with a dirty log journal. This issue allows a local user to crash or potentially escalate their privileges on the system. The flaw is related to insufficient metadata control when mounting XFS images, particularly in the `xlog recover buf commit pass2()` function within the `fs/xfs/xfs buf item recover.c` module. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.14.326 Linux kernel versions prior to 4.19.295 Linux kernel versions prior to 5.4.257 Linux kernel versions prior to 5.10.197 Linux kernel versions prior to 5.15.133 Linux kernel versions prior to 6.1.55 Linux kernel versions prior to 6.3 **Description** A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp classify` function. This issue may allow a local user to crash the system and cause a denial of service. **Recommendations** For Linux kernel versions prior to 4.14.326, update to version 4.14.326 or later. For Linux kernel versions prior to 4.19.295, update to version 4.19.295 or later. For Linux kernel versions prior to 5.4.257, update to version 5.4.257 or later. For Linux kernel versions prior to 5.10.197, update to version 5.10.197 or later. For Linux kernel versions prior to 5.15.133, update to version 5.15.133 or later. For Linux kernel versions prior to 6.1.55, update to version 6.1.55 or later. For Linux kernel versions prior to 6.3, update to version 6.3 or later.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL pointer dereference flaw was found in the `rawv6 push pending frames()` function in the network subcomponent of the Linux kernel. This flaw causes the system to crash, allowing a remote attacker to cause a denial of service. The issue is related to the handling of IPv6 traffic. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.1.5 **Description** The issue is related to the atm tc enqueue function in the Linux kernel, which can cause a denial of service due to type confusion. This confusion occurs because non-negative numbers can sometimes indicate a TC ACT SHOT condition rather than valid classification results. **Recommendations** For Linux kernel versions prior to 6.1.5, update to version 6.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the atm tc enqueue function in net/sched/sch atm.c to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 6.1.4 **Description** The issue is related to the `cbq classify` function in the Linux kernel, which can cause a denial of service due to type confusion. This confusion occurs because non-negative numbers can sometimes indicate a `TC ACT SHOT` condition rather than valid classification results, leading to a slab-out-of-bounds read. The problem is associated with incorrect type determination in the packet prioritization subsystem. **Recommendations** For Linux kernel versions through 6.1.4, update to a version that contains a fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to 5.18 Linux Kernel version 4.14 and later versions **Description** The issue is related to an improper update of the reference count in the net/sched component of the Linux Kernel, which can be exploited by a local attacker to cause privilege escalation to the root level. This allows the attacker to gain elevated privileges. **Recommendations** For Linux Kernel versions prior to 5.18, update to version 5.18 or later to resolve the issue. For Linux Kernel version 4.14 and later versions, ensure that any updates or patches related to the net/sched component are applied to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the net/sched component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NTFS-3G versions prior to 2021.8.22 **Description** The issue is related to the implementation of the ntfs get attribute value function in the NTFS-3G file system driver. It is caused by an out-of-bound buffer access due to a missing consistency check after reading an MFT record, where the `bytes in use` field should be less than the `bytes allocated` field. This can lead to a heap buffer overflow, allowing for memory disclosure or denial of service when a specially crafted NTFS attribute is supplied to the function. The vulnerability can be triggered by mounting a crafted NTFS partition. **Recommendations** For NTFS-3G versions prior to 2021.8.22, update to version 2021.8.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the ntfs get attribute value function until a patch is available. Avoid mounting crafted NTFS partitions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free flaw was found in the Linux kernel’s io uring subsystem, allowing a local user to crash or escalate their privileges on the system. This issue is related to the way a user sets up a ring with IORING SETUP IOPOLL with more than one task completing submissions on this ring. The flaw can be exploited due to a race condition, potentially leading to local escalation of privileges without requiring additional execution privileges or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a stack overflow flaw in the Linux kernel's SYSCTL subsystem, which occurs when a user changes certain kernel parameters and variables. This flaw can be exploited by a local user to crash the system or potentially escalate their privileges. The vulnerability is associated with the use of a function with inconsistent implementations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.