Steven Rostedt

### Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) ### Description: The Linux kernel contained a flaw in the function graph tracer where enabling the `funcgraph-args` option incorrectly enabled the tracer, potentially leading to a warning in the accounting system due to double registration. This occurred when the tracer was not initially registered, causing it to register a second time. Enabling function graph tracing could trigger a warning message. ### Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel's ring-buffer has been identified. The issue arises from the lack of validation for duplicate entries in the meta data subbuf array, which contains indexes of all subbuffers. This array is used to create the ring buffer link list. If duplicates are present, particularly on the writer side, it could lead to corruption of the ring buffer link list and potentially cause a kernel crash. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** To resolve this issue, apply the patch that introduces a bitmask array to track unique subbuffer entries. Specifically, create a bitmask array with the size of the number of subbuffers, clear it, and then use it to check for duplicates while walking through the subbuf array. If a duplicate entry is found, fail the validation. Otherwise, set the corresponding bit in the bitmask array for each valid entry. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to the fixed version **Description** A vulnerability in the Linux kernel has been resolved. The issue occurs when the `timerlat` tracer is started with the `osnoise` option `OSNOISE WORKLOAD` disabled, but then the option is enabled and `timerlat` is removed. The tracepoints that were enabled on `timerlat` registration do not get disabled, triggering a warning in the tracepoint code when `timerlat` is started again. To fix this, a global flag is set when the `osnoise` option is enabled, and this flag is used to disable the events when `timerlat` is removed. **Recommendations** To resolve the issue, update the Linux kernel to a version that includes the fix for this vulnerability. As a temporary workaround, consider disabling the `timerlat` tracer until a patch is available. Additionally, restrict access to the `/sys/kernel/tracing/osnoise/options` and `/sys/kernel/tracing/current tracer` files to minimize the risk of exploitation. Avoid using the `OSNOISE WORKLOAD` option in the `osnoise` tracer until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a NULL dereference in error handling within the Linux kernel, specifically in the rtla/osnoise component. When the `tool->data` allocation fails, there is no need to call `osnoise free top()`, and doing so leads to a NULL dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the way permissions are handled in the tracefs file system. When permissions are generated upon access, they default to the root inode's permission if not set by the user. However, if a remount occurs with specified permissions, only files not changed by the user are updated, while those that were changed are not. This inconsistency can lead to security issues if an administrator forgets about updated file permissions, mistakenly believing that remounting with permissions set would update all files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue concerns a problem in the Linux kernel where the `register snapshot trigger()` function did not return an error code if it failed to allocate a snapshot, instead returning 0 to indicate success. This could lead to the registration of a snapshot trigger without an error. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been resolved. The issue is related to the hci qca driver, where a timer is freed while still active, commonly triggered by calling del timer() instead of del timer sync() before freeing. This can cause a crash report due to a corrupted timer list. The hci qca driver is the possible culprit, and the wake retrans timer can be rearmed via the work queue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.