Pali Rohár

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A buffer overflow issue has been identified in the Linux kernel when parsing NFS reparse points. The problem arises because the function `cifs strndup from utf16()` accesses the `DataBuffer` beyond its bounds due to not subtracting the `InodeType` size from the `ReparseDataLength`. To fix this, the code now correctly subtracts the `InodeType` size from the `ReparseDataLength` to prevent accessing memory beyond the buffer's end. Additionally, checks have been added to ensure that `InodeType` and major and minor `rdev` values are only accessed when the reparse buffer is sufficiently large, preventing invalid memory accesses. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the buffer overflow issue when parsing NFS reparse points. As a temporary workaround, consider restricting access to the `cifs strndup from utf16()` function until the update can be applied.

The issue is related to the PCI: aardvark component in the Linux kernel, where starting a new PIO transfer by writing value 0 in the PIO START register when the previous transfer has not yet completed causes an External Abort on the CPU, resulting in a kernel panic. This happens because the kernel may issue a new PIO request while the previous one has not finished, especially during link retraining or after a link down event, which can take up to 1.44 seconds to time out. To prevent kernel panic, it is required to reject a new PIO transfer when the previous one has not finished yet. The kernel may issue a new PIO request only if the previous PIO transfer timed out.

The issue concerns the parse() method in the Email::Address module, which is susceptible to algorithmic complexity when processing specially prepared input. This can lead to a Denial of Service. The problematic input contains 30 form-field characters (`f`).

The issue is related to a buffer overflow in the custom strlcpy implementation used by UDFclient. This implementation is utilized on systems where the C library, such as glibc, does not have its own strlcpy.

The issue allows a low-privileged attacker with network access via multiple protocols to compromise the MySQL Server, potentially resulting in unauthorized access to critical data or complete access to all MySQL Server accessible data. It is difficult to exploit and requires a high level of access. Successful attacks can also cause a hang or complete denial of service (DOS) of the MySQL Server.

The issue allows remote attackers to cause a denial of service due to high CPU consumption. This can be achieved by sending a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments.