Lonial Con

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: The issue is related to the BPF verifier in the Linux kernel, where the meaning of MEM UNINIT has been overloaded, allowing a BPF program to write to a map marked as read-only. This is due to checks added later that set meta to NULL, bypassing verifier write checks to the memory. The problem arises from the double meaning of MEM UNINIT, which initially meant that the passed buffer to the BPF helper does not need to be initialized, but over time also meant that the passed buffer is being written to. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Recommendations: For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider disabling BPF programs that access read-only maps until a patch is available. Restrict access to the BPF verifier to minimize the risk of exploitation. Avoid using the `meta` argument in the `check mem reg()` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.11.5 **Description** A vulnerability has been resolved in the Linux kernel where the `sync linked regs()` function must preserve `subreg def`. Range propagation must not affect `subreg def` marks. If this issue is not addressed, the verifier may incorrectly rewrite certain code examples when the `BPF F TEST RND HI32` flag is set. This can lead to incorrect handling of register values, potentially resulting in unexpected behavior. The issue arises from the `copy register state()` function overriding the `subreg def` of `w1`, causing the verifier to insert random values for the hi32 bits of `w1` when the `BPF F TEST RND HI32` flag is set. **Recommendations** To resolve this issue, update the Linux kernel to version 6.11.5 or later. As a temporary workaround, consider disabling the use of the `BPF F TEST RND HI32` flag until the issue is resolved. Additionally, restrict the use of the `sync linked regs()` function to minimize the risk of exploitation. Avoid using the `w1` register in sensitive operations until the issue is fixed.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free vulnerability in the Linux kernel's netfilter: nf tables component can be exploited to achieve local privilege escalation. The `nft setelem catchall deactivate()` function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. **Recommendations** Upgrade past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 to resolve the issue. As a temporary workaround, consider disabling the `nft setelem catchall deactivate()` function until a patch is available. Restrict access to the vulnerable netfilter: nf tables component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A memory leak flaw was found in the `nft set catchall flush` function in the `net/netfilter/nf tables api.c` component of the Linux kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak. The exploitation of this flaw is related to the repeated freeing of previously freed memory, which may allow an attacker to access protected information or cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.