V4Bel

An issue involving path traversal occurs due to insufficient path validation. This flaw allows a malicious application to delete files for which it does not have the necessary privileges. Path traversal is a technique used to access files and directories that are stored outside the intended folder.

Insufficient input sanitization in Apple platforms allows a locally running app to reach sensitive kernel code paths. This improper input validation can lead to memory corruption, enabling an attacker to cause unexpected system termination or write to kernel memory. Such exploitation may lead to privilege escalation or full device compromise. Real-world incidents indicate that this issue is being chained with WebKit exploits to escalate from browser-based code execution to full system control.

A kernel vulnerability exists where an application may be able to leak sensitive kernel state. This issue is caused by insufficient input sanitization.

A use-after-free flaw exists in the x86 shadow MMU (Memory Management Unit) of the Kernel-based Virtual Machine (KVM) subsystem. The issue occurs in the `rmap remove()` function when a shadow paging mismatch occurs between stored and computed Guest Frame Numbers (GFNs). Specifically, if a modified Page Directory Entry (PDE) points to a non-leaf page, the `kvm mmu get child sp()` function fails to compare the role of the page and reuses it. When a memslot is dropped, the shadow page is freed, but the rmap entry survives. Subsequent operations, such as dirty logging or MMU notifier invalidation, dereference a pointer to the freed page. This can be exploited by a guest VM with root privileges to cause a host kernel panic (denial of service) or achieve guest-to-host escape to execute arbitrary code with root privileges on the host. The flaw affects both Intel and AMD CPUs and has been present in the kernel for approximately 16 years.

A critical guest-to-host escape flaw, dubbed ITScape, exists in the Kernel-based Virtual Machine (KVM) for ARM64, specifically within the vGIC-ITS (Interrupt Translation Service) emulation component. The issue is caused by a race condition in the `vgic its invalidate cache()` function, where multiple concurrent operations incorrectly drop the translation cache's reference to an entry more than once. This leads to a double-use-after-free condition, allowing an attacker in a guest operating system to execute arbitrary code with root privileges directly within the host kernel. This vulnerability specifically threatens multi-tenant ARM64 cloud environments where guest-host isolation is critical. The flaw is limited to ARM64 architectures and does not affect x86 systems.

A flaw in the XFRM ESP-in-TCP subsystem of the Linux kernel allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. This occurs because the `skb try coalesce()` function fails to preserve the `SKBFL SHARED FRAG` marker when attaching paged fragments. Consequently, the ESP input process may incorrectly identify a shared fragment as non-shared via `skb has shared frag()`, skipping the necessary `skb cow data()` call and performing in-place decryption directly over page-cache backed fragments. This deterministic logic error can be exploited to overwrite privileged binaries and gain root privileges, potentially allowing for container escape. This issue emerged as a side effect of previous fixes related to the Dirty Frag family of vulnerabilities.

A flaw in the RxRPC networking subsystem occurs when a socket buffer carrying a page-cache reference reaches the authentication verification path. The kernel performs in-place decryption directly on the referenced page without isolating the buffer. This happens because the DATA-packet handler in `rxrpc input call event()` and the RESPONSE handler in `rxrpc verify response()` only copy the socket buffer to a linear one when `skb cloned()` is true, failing to account for buffers that are not cloned but contain externally-owned paged fragments. A low-privileged local attacker can exploit this to corrupt page-cache contents of readable files, such as `/etc/passwd`, potentially obtaining root privileges. This issue may also lead to a denial of service.

Various `FilterExpressionConverter` implementations fail to properly escape keys and values when translating filter expression objects into specific vector store query languages. This improper escaping allows for query injection, which can enable attackers to alter vector store queries, potentially leading to data exposure and tampering.

Name of the Vulnerable Software and Affected Versions: Spring Cloud versions 3.1.X through 3.1.12, 4.1.X through 4.1.8, 4.2.X through 4.2.2, 4.3.X through 4.3.1, and 5.0.X through 5.0.1. Description: A flaw exists in Spring Cloud Config when substituting the profile parameter from a request to the Spring Cloud Config Server configured to use the native file system as a backend. This allows an attacker to access files outside of the configured search directories. The issue is due to improper path restriction. Recommendations: Update Spring Cloud to version 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2.

An issue in the Linux kernel is related to a use-after-free condition due to a race condition in the atalk recvmsg function. This issue affects the atalk ioctl function in the net/appletalk/ddp.c module, which is part of the Appletalk protocol implementation. The exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to a use-after-free condition in the do vcc ioctl function in the net/atm/ioctl.c module of the Linux kernel, caused by a vcc recvmsg race condition. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.