Paolo Abeni

A use-after-free issue was encountered in the Linux kernel, specifically in the net/smc component. This issue manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. The problem is caused by repeated release of LGR/link refcnt, potentially due to smc conn free() being called repeatedly without sock lock protection.

The issue is related to a memory leak in the Linux kernel, specifically in the s390/iucv component. When the MSG PEEK flag is passed to `skb recv datagram()`, it increments the `skb->users` refcount, but `iucv sock recvmsg()` does not decrement the refcount at exit. This results in a memory leak in `skb queue purge()` and a WARN ON in `iucv sock destruct()` during socket close. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include: - The `MSG PEEK` flag is used in the `skb recv datagram()` function. - The `skb->users` refcount is incremented when the `MSG PEEK` flag is passed. - The `iucv sock recvmsg()` function does not decrement the `skb->users` refcount at exit. - The memory leak occurs in `skb queue purge()`. - A WARN ON is triggered in `iucv sock destruct()` during socket close.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, related to the `net: arc` module, specifically with the `dma map single` and `dma unmap single` functions. The issue arises because `ndev->dev` and `pdev->dev` are not the same device, and using `ndev->dev.parent` is necessary as it has a `dma mask`. This vulnerability could cause a warning, as seen in the kernel log, indicating a potential issue with CPU and PID. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue arises from insufficient sanity checks in the `qdisc pkt len init()` function, specifically when handling `SKB GSO DODGY` packets. The `virtio net hdr to skb()` function does not fully dissect TCP headers, only ensuring they are at least 20 bytes long. This allows a user to craft a malicious 'GSO' packet with a total length of 80 bytes, comprising a 20-byte IPv4 header, a 60-byte TCP header, and a small `gso size` like 8. As a result, `virtio net hdr to skb()` would incorrectly identify this packet as a normal GSO packet due to the perceived payload size being larger than `gso size`. This can lead to an underflow in `qdisc skb cb(skb)->pkt len`. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider implementing additional sanity checks for `SKB GSO DODGY` packets to prevent underflow in `qdisc skb cb(skb)->pkt len`. Restrict the use of `virtio net hdr to skb()` function until the update is applied to minimize the risk of exploitation.

The issue is related to the `select local address()` and `select signal address()` functions in the Linux kernel's mptcp component. These functions select an endpoint entry from a list inside an RCU protected section but return a reference to it, which can be read later. If the entry is dereferenced after the RCU unlock, it could cause a Use-after-Free, potentially affecting the confidentiality, integrity, and availability of protected information. A simple solution is to copy the required information while inside the RCU protected section to avoid any risk of Use-after-Free later.

The vulnerability is related to the use of an uninitialized resource in the Linux kernel's net component. When using MSI/INTx interrupts, the `wx->num q vectors` variable is uninitialized, leading to a kernel panic in the `wx alloc q vectors()` function. This issue can be exploited to cause a denial of service.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a possible memory leak in the `tipc buf append` function. The ` skb linearize()` function does not free the skb when it fails, which can cause a memory leak. To fix this, the code has been modified to move `*buf = NULL` after ` skb linearize()`, allowing the skb to be freed on the error path. This vulnerability can potentially be exploited to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use-after-free condition in the do vcc ioctl function in the net/atm/ioctl.c module of the Linux kernel, caused by a vcc recvmsg race condition. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to a NULL pointer dereference in the `sk user ns()` function, which is caused by the newly allocated `skb` not having `sk` in the `unix diag get exact()` function. This can lead to a denial of service. The `unix diag get exact()` function is used to get the exact socket information. The `sk diag fill()` function is also involved, which fills the socket information. The `NETLINK CB(in skb).sk` is used to get the user namespace.

A race condition in the Linux kernel's mptcp socket handling can lead to a use-after-free (UaF) access. This occurs when the listener socket owning a relevant request is closed, freeing unaccepted subflows and causing the deletion of paired MPTCP sockets. If the mptcp socket's worker runs during this time interval, accessing `msk->first` can result in a UaF access because the subflow cleanup did not clear this field in the mptcp socket.

A slab-out-of-bounds issue has been resolved in the Linux kernel. The issue was observed while running self-tests on a KASAN enabled kernel, where a slab-out-of-bounds splat was reported, similar to a previously reported issue. The fix involves explicitly freeing the route instead of calling `fib6 info release` on a half-initialized object. Additionally, the initialization failure of `fib6 metrics` when the caller provides an `nh` needs to be taken care of.

The issue is related to the Linux kernel's handling of UDP tunnel packets. When `NETIF F GRO FRAGLIST` or `NETIF F GRO UDP FWD` are enabled and UDP tunnels are available, the `udp gro receive()` function could perform L4 aggregation at the outer UDP tunnel level, leading to inner protocol corruption. This can cause issues with packets carrying vxlan headers, where different vxlan ids may be ignored or aggregated to the same GSO packet. To resolve this, the code path for `SKB GSO UDP L4` and `SKB GSO FRAGLIST` is skipped if the packet could land in a UDP tunnel, and `udp gro receive()` is allowed to do GRO via `udp sk(sk)->gro receive`. The check implemented is broader than necessary, but covering the corner case would add complexity.

The issue is related to a flaw in the Linux kernel that allows userspace to call functions like `memcpy fromiovecend()` with a zero offset and buffer length, causing a read beyond buffer boundaries. This can lead to a memory access fault and a system halt by accessing an invalid memory address. The exploitation of this issue may allow an attacker to cause a denial of service.

The issue allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field in the ext4 journal stop function.