Piotr Krysiuk

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 6.3.1 **Description** A use-after-free vulnerability in the Linux kernel's Netfilter nf tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges due to the mishandling of anonymous sets. This vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of data or elevate their privileges in the system and execute arbitrary code. **Recommendations** Linux kernel versions through 6.3.1: As a temporary workaround, consider disabling the `nf tables commit()` function until a patch is available. Restrict access to the Netfilter nf tables module to minimize the risk of exploitation. Avoid using the `nf tables` API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.10 Description: The issue in the Linux kernel allows for the generation of undesirable machine code when transforming unprivileged cBPF programs, enabling the execution of arbitrary code within the kernel context. This occurs due to conditional branches exceeding the 128 KB limit of the MIPS architecture. Recommendations: For Linux kernel versions prior to 5.4.10, update to version 5.4.10 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.13.7 **Description** The issue allows an unprivileged BPF program to obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack. This occurs because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value. The vulnerability is related to information disclosure through inconsistency. **Recommendations** For Linux kernel versions through 5.13.7, update to a version later than 5.13.7 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.12.13 **Description** The issue is related to a branch misprediction in the Linux kernel's eBPF subsystem, which can be exploited via a side-channel attack, allowing an unprivileged BPF program to read arbitrary memory locations. This vulnerability is connected to type confusion and can be used to bypass protection against Spectre-class attacks, potentially leading to unauthorized access to protected information. The exploitation requires manipulating BPF programs to generate specific instructions that can lead to speculative execution and memory leakage through side channels. **Recommendations** For Linux kernel versions prior to 5.12.13, update to version 5.12.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of the eBPF subsystem until a patch is applied. Avoid using BPF programs that can be manipulated to generate instructions leading to speculative execution and memory leakage.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.12.7 **Description** The issue is related to a buffer overflow in the kernel/bpf/verifier.c component of the Linux kernel, allowing an attacker to perform out-of-bounds reads and writes in kernel memory. This can lead to local privilege escalation to the root level. A specific corner case involves the off reg causing a masking direction change, resulting in an incorrect final aux->alu limit. **Recommendations** For Linux kernel versions through 5.12.7, update to a version later than 5.12.7 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.12.1 **Description** The issue is related to the Linux kernel's BPF subsystem, which has weaknesses in its authorization mechanism. This can allow an attacker to gain unauthorized access to protected information. Specifically, the kernel/bpf/verifier.c in the Linux kernel performs undesirable speculative loads, leading to the disclosure of stack content via side-channel attacks. The BPF stack area is not protected against speculative loads, and it can contain uninitialized data that might represent sensitive information previously operated on by the kernel. **Recommendations** For Linux kernel versions through 5.12.1, consider updating to a version that addresses the issue with speculative loads in the BPF subsystem to prevent unauthorized access to sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.11.x **Description** An issue in the Linux kernel allows for undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks. This can defeat Spectre mitigations and obtain sensitive information from kernel memory. The issue is related to the `kernel/bpf/verifier.c` component and involves the incorrect accounting of pointer modification during sequences of pointer arithmetic operations. **Recommendations** For Linux kernel versions through 5.11.x, consider applying a patch or update that addresses the issue in `kernel/bpf/verifier.c` to prevent out-of-bounds speculation on pointer arithmetic. As a temporary workaround, consider restricting access to sensitive kernel memory or disabling the `verifier.c` component until a patch is available.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.11.8 Description: An issue in the Linux kernel affects the kernel/bpf/verifier.c file, causing an off-by-one error with a resultant integer underflow. This error leads to out-of-bounds speculation on pointer arithmetic, allowing side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Recommendations: For Linux kernel versions prior to 5.11.8, update to version 5.11.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the kernel/bpf/verifier.c file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.11.8 Description: The issue is related to the Linux kernel's kernel/bpf/verifier.c file, which performs undesirable out-of-bounds speculation on pointer arithmetic. This can lead to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. The issue affects pointer types that do not define a ptr limit. Recommendations: For Linux kernel versions prior to 5.11.8, update to version 5.11.8 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and limiting the use of pointer types that do not define a ptr limit to minimize the risk of exploitation.