A flaw was found in codec-haproxy from the Netty project. This flaw allows an attacker to build a malformed crafted message and cause infinite recursion, causing stack exhaustion and leading to a denial of service (DoS).

Stack overflow in PJSUA API when calling pjsuaplayercreate. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

stb stbimage.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbioutgifcode function.

A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute (called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.

Last updated 24 March 2025

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in allocpool in pool.c, and possible remote code execution.

Summary

Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.

Mitigations

To mitigate this protocol vulnerability, OpenSSH suggested a so-called "strict kex" which alters the SSH handshake to ensure a Man-in-the-Middle attacker cannot introduce unauthenticated messages as well as convey sequence number manipulation across handshakes.

Warning: To take effect, both the client and server must support this countermeasure.

As a stop-gap measure, peers may also (temporarily) disable the affected algorithms and use unaffected alternatives like AES-GCM instead until patches are available.

Details

The SSH specifications of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com MACs) are vulnerable against an arbitrary prefix truncation attack (a.k.a. Terrapin attack). This allows for an extension negotiation downgrade by stripping the SSHMSGEXTINFO sent after the first message after SSHMSGNEWKEYS, downgrading security, and disabling attack countermeasures in some versions of OpenSSH. When targeting Encrypt-then-MAC, this attack requires the use of a CBC cipher to be practically exploitable due to the internal workings of the cipher mode. Additionally, this novel attack technique can be used to exploit previously unexploitable implementation flaws in a Man-in-the-Middle scenario.

The attack works by an attacker injecting an arbitrary number of SSHMSGIGNORE messages during the initial key exchange and consequently removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSHMSGIGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange.

In the case of ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher does not maintain an internal state other than the message's sequence number. In the case of Encrypt-Then-MAC, practical exploitation requires the use of a CBC cipher; while theoretical integrity is broken for all ciphers when using this mode, message processing will fail at the application layer for CTR and stream ciphers.

For more details see https://terrapin-attack.com.

Impact

This attack targets the specification of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com), which are widely adopted by well-known SSH implementations and can be considered de-facto standard. These algorithms can be practically exploited; however, in the case of Encrypt-Then-MAC, we additionally require the use of a CBC cipher. As a consequence, this attack works against all well-behaving SSH implementations supporting either of those algorithms and can be used to downgrade (but not fully strip) connection security in case SSH extension negotiation (RFC8308) is supported. The attack may also enable attackers to exploit certain implementation flaws in a man-in-the-middle (MitM) scenario.

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

An arbitrary file copy vulnerability in modcopy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.

A vulnerability was found in icoutils in extract.c. It is possible to access unallocated memory via wrestool while parsing maliciously crafted file which would make the application crash or possibly allow code execution.

References:

http://seclists.org/oss-sec/2017/q1/56

Upstream patch:

http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a

A flaw in the Linux Kernel found. For the netfilter, nftablesnewrule when adding a rule with NFTARULECHAINID can lead to use-after-free.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0ebc1064e4874d5987722a2ddbc18f94aa53b211

Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty.

httparty/lib/httparty/request > body.rb > def generatemultipart

https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43

By exploiting this problem, the following attacks are possible

An attack that rewrites the "name" field according to the crafted file name, impersonating (overwriting) another field. Attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename

For example, this vulnerability can be exploited to generate the following Content-Disposition.

Normal Request example: normal input filename: abc.txt generated normal header in multipart/form-data Content-Disposition: form-data; name="avatar"; filename="abc.txt" Malicious Request example malicious input filename: overwritenamefieldandextension.sh"; name="foo"; dummy=".txt generated malicious header in multipart/form-data: Content-Disposition: form-data; name="avatar"; filename="overwritenamefieldandextension.sh"; name="foo"; dummy=".txt"

The Abused Header has multiple name ( avatar & foo ) fields and the "filename" has been rewritten from .txt to .sh .

These problems can result in successful or unsuccessful attacks, depending on the behavior of the parser receiving the request. I have confirmed that the attack succeeds, at least in the following frameworks

Spring (Java) Ktor (Kotlin) Ruby on Rails (Ruby)

The cause of this problem is the lack of escaping of the " (Double-Quote) character in Content-Disposition > filename.

WhatWG's HTML spec has an escaping requirement.

https://html.spec.whatwg.org/#multipart-form-data

For field names and filenames for file fields, the result of the encoding in the previous bullet point must be escaped by replacing any 0x0A (LF) bytes with the byte sequence %0A, 0x0D (CR) with %0D and 0x22 (") with %22. The user agent must not perform any other escapes.

Patches

As noted at the beginning of this section, encoding must be done as described in the HTML Spec.

https://html.spec.whatwg.org/#multipart-form-data

For field names and filenames for file fields, the result of the encoding in the previous bullet point must be escaped by replacing any 0x0A (LF) bytes with the byte sequence %0A, 0x0D (CR) with %0D and 0x22 (") with %22. The user agent must not perform any other escapes.

Therefore, it is recommended that Content-Disposition be modified by either of the following

Before: Content-Disposition: attachment;filename="malicious.sh";dummy=.txt

After: Content-Disposition: attachment;filename="%22malicious.sh%22;dummy=.txt"

https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43

filename.gsub('"', '%22')

Also, as for \r, \n, URL Encode is not done, but it is not newlines, so it seemed to be OK. However, since there may be omissions, it is safer to URL encode these as well, if possible. ( \r to %0A and \d to %0D )

PoC

PoC Environment

OS: macOS Monterey(12.3) Ruby ver: ruby 3.1.2p20 httparty ver: 0.20.0 (Python3 - HTTP Request Logging Server)

PoC procedure

(Linux or MacOS is required. This is because Windows does not allow file names containing " (double-quote) .)

1. Create Project $ mkdir my-app $ cd my-app $ gem install httparty

2. Create malicious file

$ touch 'overwritenamefieldandextension.sh"; name="foo"; dummy=".txt'

3. Generate Vuln code

$ vi example.rb

require 'httparty'

filename = 'overwritenamefieldandextension.sh"; name="foo"; dummy=".txt'

HTTParty.post('http://localhost:12345/', body: { name: 'Foo Bar', email: 'example@email.com', avatar: File.open(filename) } )

4. Run Logging Server

I write Python code, but any method will work as long as you can see the HTTP Request Body. (e.g. Debugger, HTTP Logging Server, Packet Capture)

$ vi logging.py from http.server import HTTPServer from http.server import BaseHTTPRequestHandler

class LoggingServer(BaseHTTPRequestHandler):

def doPOST(self): self.sendresponse(200) self.endheaders() self.wfile.write("ok".encode("utf-8"))

contentlength = int(self.headers['Content-Length']) postdata = self.rfile.read(contentlength) print("POST request,\nPath: %s\nHeaders:\n%s\n\nBody:\n%s\n", str(self.path), str(self.headers), postdata.decode('utf-8')) self.wfile.write("POST request for {}".format(self.path).encode('utf-8'))

ip = '127.0.0.1' port = 12345

server = HTTPServer((ip, port), LoggingServer) server.serveforever()

$ python logging.py

5. Run & Logging server

$ run example.rb

Return Request Header & Body:

User-Agent: Ruby Content-Type: multipart/form-data; boundary=------------------------F857UcxRc2J1zFOz Connection: close Host: localhost:12345 Content-Length: 457 --------------------------F857UcxRc2J1zFOz Content-Disposition: form-data; name="name" Foo Bar --------------------------F857UcxRc2J1zFOz Content-Disposition: form-data; name="email" example@email.com --------------------------F857UcxRc2J1zFOz Content-Disposition: form-data; name="avatar"; filename="overwritenamefieldandextension.sh"; name="foo"; dummy=".txt" Content-Type: text/plain abc --------------------------F857UcxRc2J1zFOz--

Content-Disposition: Content-Disposition: form-data; name="avatar"; filename="overwritenamefieldandextension.sh"; name="foo"; dummy=".txt"

name fields is duplicate (avator & foo) filename & extension tampering ( .txt --> .sh )

References

1. I also include a similar report that I previously reported to Firefox. https://bugzilla.mozilla.org/showbug.cgi?id=1556711

2. I will post some examples of frameworks that did not have problems as reference.

Golang https://github.com/golang/go/blob/e0e0c8fe9881bbbfe689ad94ca5dddbb252e4233/src/mime/multipart/writer.go#L144

Spring https://github.com/spring-projects/spring-framework/blob/4cc91e46b210b4e4e7ed182f93994511391b54ed/spring-web/src/main/java/org/springframework/http/ContentDisposition.java#L259-L267

Symphony https://github.com/symfony/symfony/blob/123b1651c4a7e219ba59074441badfac65525efe/src/Symfony/Component/Mime/Header/ParameterizedHeader.php#L128-L133

For more information If you have any questions or comments about this advisory: Email us at kumagoroalice@yahoo.co.jp

An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.

A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.

An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application termination or arbitrary code execution.

A heap-based buffer over write vulnerability was found in GhostScript's lp8000printpage() function in gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

========== 1. Null-ptr-deref in xfrmupdateaeparams() ==========

[require privilege]: CAPNETADMIN

[effects]: local DoS

[crash stack]: [ 47.933119] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 47.933119] #PF: supervisor write access in kernel mode [ 47.933119] #PF: errorcode(0x0002) - not-present page [ 47.933119] PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 [ 47.933119] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 47.933119] CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 [ 47.933119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 [ 47.933119] RIP: 0010:memcpyorig+0xad/0x140 [ 47.933119] Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c [ 47.933119] RSP: 0018:ffff888008f57658 EFLAGS: 00000202 [ 47.933119] RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 [ 47.933119] RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 [ 47.933119] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 47.933119] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 [ 47.933119] R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 [ 47.933119] FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 47.933119] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.933119] CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 [ 47.933119] Call Trace: [ 47.933119] <TASK> [ 47.933119] ? die+0x1f/0x70 [ 47.933119] ? pagefaultoops+0x1e8/0x500 [ 47.933119] ? pfxisprefetch.constprop.0+0x10/0x10 [ 47.933119] ? pfxpagefaultoops+0x10/0x10 [ 47.933119] ? rawspinunlockirqrestore+0x11/0x40 [ 47.933119] ? fixupexception+0x36/0x460 [ 47.933119] ? rawspinunlockirqrestore+0x11/0x40 [ 47.933119] ? excpagefault+0x5e/0xc0 [ 47.933119] ? asmexcpagefault+0x26/0x30 [ 47.933119] ? xfrmupdateaeparams+0xd1/0x260 [ 47.933119] ? memcpyorig+0xad/0x140 [ 47.933119] ? pfxrawspinlockbh+0x10/0x10 [ 47.933119] xfrmupdateaeparams+0xe7/0x260 [ 47.933119] xfrmnewae+0x298/0x4e0 [ 47.933119] ? pfxxfrmnewae+0x10/0x10 [ 47.933119] xfrmuserrcvmsg+0x25a/0x410 [ 47.933119] ? pfxxfrmuserrcvmsg+0x10/0x10 [ 47.933119] ? allocskb+0xcf/0x210 [ 47.933119] ? stacktracesave+0x90/0xd0 [ 47.933119] ? filterirqstacks+0x1c/0x70 [ 47.933119] ? stackdepotsave+0x39/0x4e0 [ 47.933119] ? kasanslabfree+0x10a/0x190 [ 47.933119] ? kmemcachefree+0x9c/0x340 [ 47.933119] ? netlinkrecvmsg+0x23c/0x660 [ 47.933119] ? sockrecvmsg+0xeb/0xf0 [ 47.933119] ? sysrecvfrom+0x13c/0x1f0 [ 47.933119] ? x64sysrecvfrom+0x71/0x90 [ 47.933119] ? dosyscall64+0x3f/0x90 [ 47.933119] ? entrySYSCALL64afterhwframe+0x72/0xdc [ 47.933119] ? copyout+0x3e/0x50 [ 47.933119] netlinkrcvskb+0xd6/0x210 [ 47.933119] ? pfxxfrmuserrcvmsg+0x10/0x10 [ 47.933119] ? pfxnetlinkrcvskb+0x10/0x10 [ 47.933119] ? pfxsockhasperm+0x10/0x10 [ 47.933119] ? mutexlock+0x8d/0xe0 [ 47.933119] ? pfxmutexlock+0x10/0x10 [ 47.933119] xfrmnetlinkrcv+0x44/0x50 [ 47.933119] netlinkunicast+0x36f/0x4c0 [ 47.933119] ? pfxnetlinkunicast+0x10/0x10 [ 47.933119] ? netlinkrecvmsg+0x500/0x660 [ 47.933119] netlinksendmsg+0x3b7/0x700 [ 47.933119] ? pfxnetlinksendmsg+0x10/0x10 [ 47.933119] ? updateloadavg+0x591/0xab0 [ 47.933119] ? pfxnetlinksendmsg+0x10/0x10 [ 47.933119] socksendmsg+0xde/0xe0 [ 47.933119] syssendto+0x18d/0x230 [ 47.933119] ? pfxsyssendto+0x10/0x10 [ 47.933119] ? rbinsertcolor+0x1c0/0x280 [ 47.933119] ? timerqueueadd+0x128/0x150 [ 47.933119] ? ktimeget+0x49/0xb0 [ 47.933119] ? pfxnativeapicmemwrite+0x10/0x10 [ 47.933119] ? lapicnextevent+0x35/0x40 [ 47.933119] ? clockeventsprogramevent+0xdf/0x140 [ 47.933119] ? hrtimerinterrupt+0x321/0x360 [ 47.933119] x64syssendto+0x71/0x90 [ 47.933119] dosyscall64+0x3f/0x90 [ 47.933119] entrySYSCALL64afterhwframe+0x72/0xdc [ 47.933119] RIP: 0033:0x44b8aa [ 47.933119] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 9 [ 47.933119] RSP: 002b:00007fff7ded8258 EFLAGS: 00000246 ORIGRAX: 000000000000002c [ 47.933119] RAX: ffffffffffffffda RBX: 00007fff7ded9688 RCX: 000000000044b8aa [ 47.933119] RDX: 00000000000002a8 RSI: 00007fff7ded8480 RDI: 0000000000000003 [ 47.933119] RBP: 00007fff7ded82c0 R08: 00007fff7ded829c R09: 000000000000000c [ 47.933119] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 47.933119] R13: 00007fff7ded9678 R14: 00000000004c37d0 R15: 0000000000000001 [ 47.933119] </TASK> [ 47.933119] Modules linked in: [ 47.933119] CR2: 0000000000000000 [ 47.933119] ---[ end trace 0000000000000000 ]--- [ 47.933119] RIP: 0010:memcpyorig+0xad/0x140 [ 47.933119] Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c [ 47.933119] RSP: 0018:ffff888008f57658 EFLAGS: 00000202 [ 47.933119] RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 [ 47.933119] RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 [ 47.933119] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 47.933119] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 [ 47.933119] R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 [ 47.933119] FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 47.933119] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.933119] CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 [ 47.933119] Kernel panic - not syncing: Fatal exception in interrupt [ 47.933119] Kernel Offset: disabled [ 47.933119] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

[buggy commit]: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows")

[root cause]: x->replayesn and x->preplayesn should be allocated at xfrmallocreplaystateesn(...) in xfrmstateconstruct(..), and then the xfrmupdateaeparams(...) is okay to update them. However, the current implementation allows a malicious user to directly dereference the pointer and crash the kernel like above.

[PoC code]: see attachment poc1.c. I have tested it in ubuntu 22.04 and latest Linux with QEMU.

[suggest fix]: Add NULL check in xfrmupdateaeparams() like below:

@@ -628,7 +628,7 @@ static void xfrmupdateaeparams(struct xfrmstate x, struct nlattr attrs, struct nlattr rt = attrs[XFRMAREPLAYTHRESH]; struct nlattr mt = attrs[XFRMAMTIMERTHRESH];

- if (re) { + if (re && x->replayesn && x->preplayesn) { struct xfrmreplaystateesn replayesn;

A flaw in the Linux Kernel found. Improper element removal in function nftpipaporemove when insert an element without a NFTSETEXTKEYEND that can lead to use-after-free.

Reference: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230719190824.21196-1-fw@strlen.de/

A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSETCMDADD and IPSETCMDSWAP can lead to a kernel panic due to the invocation of ipsetput on a wrong set. This issue may allow a local user to crash the system.

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

A flaw found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAPNETADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. The original fix for the CVE-2023-1076 was incorrect. The problem is that the following upstream commits (that were fix for the CVE-2023-1076) - a096ccca6e50 ("tun: tunchropen(): correctly initialize socket uid"), - 66b2c338adce ("tap: tapopen(): correctly initialize socket uid"), pass "inode->iuid" to sockinitdatauid() as the last parameter and that turns out to be entirely bogus.

References: https://lore.kernel.org/all/20230731164237.48365-1-lersek@redhat.com/ https://lore.kernel.org/all/20230731164237.48365-2-lersek@redhat.com/ https://lore.kernel.org/all/20230731164237.48365-3-lersek@redhat.com/