Wenqing Liu

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.17-rc4 through 5.17-rc6 linux-image-5.10.142-1-generic linux-image-5.10.142-1-hardened linux-image-5.15.0-33-generic linux-image-5.15.0-33-hardened linux-image-5.15.0-33-lowlatency linux-image-5.15.0-70-generic linux-image-5.15.0-70-hardened linux-image-5.15.0-70-lowlatency **Description** An array-index-out-of-bounds issue exists in the Linux kernel when mounting and operating a corrupted image. The root cause is a missing sanity check on the `curseg->alloc type` variable within the `sanity check curseg()` function, which leads to out-of-bounds access of the `sbi->block count[]` array. This can impact the confidentiality, integrity, and availability of protected information. **Recommendations** Update the Linux kernel to a version where the sanity check for `curseg->alloc type` has been implemented. Update linux-image-5.10.142-1-generic to a patched version. Update linux-image-5.10.142-1-hardened to a patched version. Update linux-image-5.15.0-33-generic to a patched version. Update linux-image-5.15.0-33-hardened to a patched version. Update linux-image-5.15.0-33-lowlatency to a patched version. Update linux-image-5.15.0-70-generic to a patched version. Update linux-image-5.15.0-70-hardened to a patched version. Update linux-image-5.15.0-70-lowlatency to a patched version.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been identified, which can cause a kernel panic. The issue arises when the `inline dots` flag is set in a special file, such as a character, block, FIFO, or socket file, and the `f2fs` filesystem attempts to recover dot dentries. This can lead to a NULL pointer access when `f2fs add regular entry()` calls `a ops->set dirty page()`. The vulnerability can be triggered by creating a directory, mounting a fuzzed image, and listing the directory contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.15.11 **Description** The issue arises from an out-of-bounds memory access in the ` f2fs setxattr` function in `fs/f2fs/xattr.c` when an inode has an invalid last xattr entry. This can potentially impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Linux kernel versions through 5.15.11, update to a version later than 5.15.11 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.16.3 **Description** The issue is related to the gc data segment function in the Linux kernel, specifically in fs/f2fs/gc.c. It involves a NULL pointer dereference due to special files not being considered, which can lead to a denial of service. An attacker could potentially exploit this issue to cause a service disruption. **Recommendations** For Linux kernel versions prior to 5.16.3, update to version 5.16.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the gc data segment function in fs/f2fs/gc.c to minimize the risk of exploitation.