Tsune

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A race condition exists in the TIOCSCTTY ioctl handler. The handler releases the tty lock to acquire the process tree lock but fails to revalidate the terminal state after reacquiring the tty lock. This allows a terminal being concurrently destroyed to be linked to the calling process session, enabling an unprivileged local user to escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A race condition exists in the `FIOSSHMLPGCNF` ioctl(2) operation used to configure the page size for a largepage shared memory object. The handler fails to hold the `rangelock` when checking if a page size has already been configured. This allows two concurrent callers to observe an unconfigured object and set conflicting page sizes, resulting in an inconsistent state. An unprivileged local user can exploit this flaw to escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.