Przemyslaw Frasunek

A stack buffer overflow exists in the `setcred(2)` system call. The issue occurs because a user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer before the privilege level of the caller is verified and without validating the length of the list. An unprivileged local user can trigger this overflow, potentially allowing the execution of arbitrary code within the kernel context to gain elevated privileges.

The `receive xattr()` function relies on an untrusted length value during a `qsort()` call, which can lead to a use-after-free condition on the receiver side. This occurs when the victim runs the software with the `-X` (or `--xattrs`) option. While many common configurations on Linux are affected, non-Linux platforms are more widely susceptible.

A race condition exists in the Pipe (IPC) close function, which can be exploited by local users to cause a denial of service (crash) or gain privileges. This issue is related to kqueues and can trigger a use after free, resulting in a NULL pointer dereference or memory corruption.

Name of the Vulnerable Software and Affected Versions: Sun Solaris 10 on x86 systems Description: The issue allows local users to execute arbitrary code with PRIV NET RAWACCESS privileges. This can be achieved through either a large number of -g arguments or a malformed -s argument with a trailing dot. Recommendations: For Sun Solaris 10 on x86 systems, consider restricting the use of the `traceroute` command until a patch is available. As a temporary workaround, limit the number of -g arguments and avoid using malformed -s arguments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to obtain sensitive information by sniffing the network, as the device contains portions of memory in an ARP request.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and memory consumption. This occurs when a packet with invalid data is sent to UDP port 1701, causing the `l2tp avp print` function to use a bad length value when calling `print octets`.