Solar Designer

An improper privilege management issue exists in the Linux kernel's ptrace mechanism, specifically within the `get dumpable()` and ` ptrace may access()` functions. The flaw stems from a logic error where the system incorrectly handles the dumpability of tasks that lack an associated memory management (mm) pointer, such as kernel threads. This allows an unprivileged local user to bypass privilege boundaries and access file descriptors of other processes. In certain scenarios, this can be exploited via a race condition during process shutdown to steal privileged file descriptors, leading to local root privilege escalation and the disclosure of sensitive credentials, including SSH private keys and `/etc/shadow` password hashes. Successful exploitation may require the Reliable Datagram Sockets (RDS) module to be loaded, `io ring` to be enabled, and the presence of a readable SUID-root binary on x86 64 systems.

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 8.7 and 8.8 Description: A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server. The vulnerability affects OpenSSH versions 8.7 and 8.8, including their corresponding portable releases, and is estimated to potentially affect over 98 million systems. Recommendations: To resolve the issue for OpenSSH versions 8.7 and 8.8, set the LoginGraceTime parameter to 0 in the sshd configuration. This method effectively blocks the vulnerability. Additionally, updating to a newer version of OpenSSH that includes the fix for this vulnerability is recommended. AlmaLinux 9 has released a patch for this vulnerability.

A flaw in the grub2-set-bootflag utility of grub2 can lead to a denial of service. The issue arises when the program creates a temporary file with new grubenv content and is killed before renaming it to the original grubenv file, resulting in the temporary file not being removed. This can cause the filesystem to fill up with temporary files when the utility is invoked multiple times, leading to a filesystem out of free inodes or blocks. The vulnerability is related to incomplete cleanup of temporary or auxiliary resources.

The issue concerns bcrypt password hashing in Botan, where passwords with a length between 57 and 72 characters are not handled correctly. This incorrect handling makes it easier for attackers to determine the cleartext password.

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. The vulnerability is related to errors in the authentication procedure of the vgauth module in VMware Tools. Exploitation of this issue may allow an attacker to affect the confidentiality and integrity of protected information. Chinese state-sponsored group UNC3886 has been exploiting this vulnerability since 2021 to backdoor Windows, Linux, and PhotonOS systems.

The issue is related to an integer overflow in the `ext4 write inline data end()` function of the openEuler kernel on Linux, specifically in the filesystem modules. This allows for a forced integer overflow, which can impact the confidentiality, integrity, and availability of protected information.

The issue is related to the cron package, where the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the `chown` and `chmod` programs. This can be exploited by an attacker to gain elevated privileges.

The issue is related to the `ping unhash` function in the Linux kernel, specifically in the `net/ipv4/ping.c` file. It is associated with inadequate access control. The exploitation of this issue can allow a local attacker to cause a denial of service by utilizing access to the `IPPROTO ICMP` protocol value in a socket system call. This can lead to a system panic.

The issue concerns the IPv4 implementation in the Linux kernel, which fails to properly handle the destruction of device objects. This allows guest OS users to cause a denial of service, resulting in a host OS networking outage, by arranging for a large number of IP addresses.

The issue allows context-dependent attackers to guess passwords via a brute-force attack because weak non-tty passwords are generated.

The issue allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename. This could possibly lead to the execution of arbitrary code as a consequence of writing to a dotfile in a home directory. Exploitation of this issue may lead to a breach of confidentiality, integrity, and availability of protected information and can be carried out remotely.

The issue allows remote servers to create or overwrite files through a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename. This can possibly lead to the execution of arbitrary code as a consequence of writing to a dotfile in a home directory. The problem arises because the software does not reject downloads to filenames that begin with a . (dot) character.

Name of the Vulnerable Software and Affected Versions: Linux kernel version 2.6.9 Description: The issue concerns the z90crypt unlocked ioctl function in the z90crypt driver, which fails to perform a capability check for the Z90QUIESCE operation. This allows local users with euid 0 privileges to cause a driver outage. Recommendations: For Linux kernel version 2.6.9, consider disabling the z90crypt driver or restricting its use to prevent exploitation until a fix is available.

Name of the Vulnerable Software and Affected Versions: Linux kernel version 2.6.16 Description: A race condition exists in the do add counters function in netfilter for the Linux kernel, allowing local users with CAP NET ADMIN capabilities to read kernel memory. This is achieved by triggering the race condition to produce a size value inconsistent with allocated memory, resulting in a buffer over-read in IPT ENTRY ITERATE. Recommendations: For Linux kernel version 2.6.16, consider restricting access to the do add counters function or applying configuration changes to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux versions prior to 2.6.16-rc3 Description: The issue is related to an integer overflow in the do replace function in netfilter for Linux. This can be exploited by local users with CAP NET ADMIN rights to cause a buffer overflow in the copy from user function, particularly when using virtualization solutions such as OpenVZ. Recommendations: For Linux versions prior to 2.6.16-rc3, update to version 2.6.16-rc3 or later to resolve the issue. As a temporary workaround, consider restricting the use of CAP NET ADMIN rights to minimize the risk of exploitation.

The issue is related to a buffer overflow in the logging capability for the DHCP daemon. This can be triggered by remote attackers sending multiple hostname options in various DHCP messages, such as DISCOVER, OFFER, REQUEST, ACK, or NAK messages. The vulnerability can cause a denial of service, resulting in a server crash, and potentially allow the execution of arbitrary code when a long string is generated while writing to a log file.

The issue arises when the DHCP daemon (DHCPD) for ISC DHCP is compiled in environments lacking the vsnprintf function, leading to the use of C include files that define vsnprintf to use the less safe vsprintf function. This can result in buffer overflow vulnerabilities, enabling a denial of service (server crash) and possibly allowing the execution of arbitrary code.

The issue allows remote attackers to determine valid usernames via a timing attack when a user does not exist, due to the immediate sending of an error message with PAM support enabled. This can lead to a violation of confidentiality. The vulnerability can be exploited remotely.

The issue affects the kernel packages in various Linux distributions, including Debian GNU/Linux and Red Hat Linux. The vulnerabilities can be exploited by a local or remote attacker to compromise the confidentiality, integrity, and availability of protected information. The exploitation can lead to information leaks, allowing privileged users to obtain portions of kernel memory.