Moshe Kol

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.17.9 **Description** The issue is related to insufficient entropy in the Linux kernel, allowing a remote attacker to identify clients by determining the original source ports used by the TCP server. This is due to the use of Algorithm 4, also known as the Double-Hash Port Selection Algorithm, as defined in RFC 6056. **Recommendations** For Linux kernel versions prior to 5.17.9, update to version 5.17.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a memory leak problem in the TCP source port generation algorithm, which may allow an attacker to leak information and potentially cause a denial of service problem. This is due to the small table perturb size in the net/ipv4/tcp.c component. The exploitation of this issue may enable a remote attacker to predict the number of an outgoing TCP connection port. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.83 **Description** A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. **Recommendations** For versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS server to minimize the risk of exploitation. Avoid using the `sort rrset()` function in the `dnssec.c` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.83 **Description** A buffer overflow vulnerability was discovered in the way dnsmasq extracts names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the `extract name()` function, which writes data to the memory pointed by `name` assuming `MAXDNAME*2` bytes are available in the buffer. However, in some code execution paths, it is possible `extract name()` gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. **Recommendations** As a temporary workaround, consider disabling the `extract name()` function until a patch is available. Update to version 2.83 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.83 **Description** A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. The issue is caused by the lack of length checks in `extract name()` function in rfc1035.c, which could be abused to make the code execute `memcpy()` with a negative size in `sort rrset()` and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this issue is to system availability. **Recommendations** For dnsmasq versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider disabling DNSSEC until a patch is available. Restrict access to the `extract name()` function in rfc1035.c to minimize the risk of exploitation. Avoid using the `sort rrset()` function with unvalidated input until the issue is resolved.