A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation.

The function nftpipapowalk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

A flaw in the Linux Kernel found. When splice() is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer (struct skmsgsg) are unused writable memory. This can cause subsequent writes to the socket to overwrite the contents of spliced pages, including pages from files to which the caller is not supposed to have write access.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267

An Out-Of-Bounds Read vulnerability in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This flaw could allow a local attacker to crash the system or leak internal kernel information.

Refer; https://bugzilla.kernel.org/showbug.cgi?id=218218

[1] Retrieve WordCount and add offset2 to the data part of smb [2] Retrieve a 16-byte value from the calculated pointer

c unsigned int smbCalcSize(void buf) { struct smbhdr ptr = buf; return (sizeof(struct smbhdr) + (2 ptr->WordCount) + 2 / size of the bcc field / + getbcc(ptr)); } ... static inline u16 getbcc(struct smbhdr hdr) { le16 bcptr = (le16 )BCC(hdr);

return getunalignedle16(bcptr);//[2] } ... static inline void BCC(struct smbhdr smb) { return (void )smb + sizeof(smb) + 2 smb->WordCount; //[1] }

[2] cifsdemultiplexthread → standardreceive3 → cifshandlestandard → checkSMB → smbCalcSize

c int checkSMB(char buf, unsigned int totalread, struct TCPServerInfo server) { struct smbhdr smb = (struct smbhdr )buf; u32 rfclen = be32tocpu(smb->smbbuflength); u32 clclen; / calculated length / cifsdbg(FYI, "checkSMB Length: 0x%x, smbbuflength: 0x%x\n", totalread, rfclen);

/ is this frame too small to even get to a BCC? / if (totalread < 2 + sizeof(struct smbhdr)) { ... }

/ otherwise, there is enough to get to the BCC / if (checksmbhdr(smb)) return -EIO; clclen = smbCalcSize(smb);

An Out-Of-Bounds Read vulnerability in smb2dumpdetail in fs/smb/client/smb2ops.c in the Linux Kernel. This flaw could allow a local attacker to crash the system or leak internal kernel information.

Refer: https://bugzilla.kernel.org/showbug.cgi?id=218219

1] If CONFIGCIFSDEBUG2 is set, then cifsdemultiplexthread calls dumpdetail.

static int cifsdemultiplexthread(void p) { ... for (i = 0; i < nummids; i++) { if (mids[i] != NULL) { mids[i]->respbufsize = server->pdusize;

if (bufs[i] != NULL) { if (server->ops->isnetworknamedeleted && server->ops->isnetworknamedeleted(bufs[i], server)) { cifsserverdbg(FYI, "Share deleted. Reconnect needed"); } }

if (!mids[i]->multiRsp || mids[i]->multiEnd) mids[i]->callback(mids[i]);

releasemid(mids[i]); } else if (server->ops->isoplockbreak && server->ops->isoplockbreak(bufs[i], server)) { smb2addcreditsfromhdr(bufs[i], server); cifsdbg(FYI, "Received oplock break\n"); } else { cifsserverdbg(VFS, "No task to wake, unknown frame received! NumMids %d\n", atomicread(&midcount)); cifsdumpmem("Received Data is: ", bufs[i], HEADERSIZE(server)); smb2addcreditsfromhdr(bufs[i], server); #ifdef CONFIGCIFSDEBUG2 if (server->ops->dumpdetail) server->ops->dumpdetail(bufs[i], server);//[1] cifsdumpmids(server); #endif / CIFSDEBUG2 / } } //[2]In smb2dumpdetail, calcsmbsize is called, which refers to smb2calcsize.

static void smb2dumpdetail(void buf, struct TCPServerInfo server) { #ifdef CONFIGCIFSDEBUG2 struct smb2hdr shdr = (struct smb2hdr )buf;

cifsserverdbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, shdr->Id.SyncId.ProcessId); cifsserverdbg(VFS, "smb buf %p len %u\n", buf, server->ops->calcsmbsize(buf));//[2] #endif } In hassmb2dataarea, it attempts to retrieve an element at the index le16tocpu(shdr->Command). If a value larger than the length of hassmb2dataarea is input, an OOB (Out-Of-Bounds) Read occurs."

unsigned int smb2calcsize(void buf) { struct smb2pdu pdu = buf; struct smb2hdr shdr = &pdu->hdr; int offset; / the offset from the beginning of SMB to data area / int datalength; / the length of the variable length data area / / Structure Size has already been checked to make sure it is 64 / int len = le16tocpu(shdr->StructureSize);

/ StructureSize2, ie length of fixed parameter area has already been checked to make sure it is the correct length. / len += le16tocpu(pdu->StructureSize2);

if (hassmb2dataarea[le16tocpu(shdr->Command)] == false)//[3] goto calcsizeexit;

An issue was discovered in the Linux kernel before 6.5.9 exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.

If perfreadgroup() is called while an event's siblinglist is smaller than its child's siblinglist, it can increment or write to memory locations outside of the allocated buffer.

We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

Last updated 30 August 2024

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. In this flaw, a malicious user can cause a UAF and a double free, which may lead to RCE (may also lead to an LPE in case the attacker already has local privileges).

Reference: https://lore.kernel.org/linux-nvme/20231002105428.226515-1-sagi@grimberg.me/

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfqdequeue() due to the incorrect .peek handler of schplug and lack of error checking in aggdequeue().

References: https://github.com/torvalds/linux/commit/8fc134fee27f2263988ae38920bc03da416b03d8

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

A use-after-free vulnerability in the Linux kernel's net/sched: schhfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSCFSC flag set) has a parent without a link-sharing curve, then initvf() will call vttreeinsert() on the parent, but vttreeremove() will be skipped in updatevf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

A use-after-free vulnerability in the Linux kernel's afunix component can be exploited to achieve local privilege escalation.

The unixstreamsendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unixstreamsendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c (or backported equivalents).

An issue was discovered in l2capsockrelease in net/bluetooth/l2capsock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.

A flaw in the Linux Kernel found. Use after free in the net/sched classifiers (clsfw, clsu32 and clsroute) can happen because of mainline/net/sched/clsfw.c incorrect handling of the existing filter in .change method that leads to an extra unbindtcf call for the associated class and that allows that class to be removed while it's still used. These bugs can be used for a local privilege escalation.

Upstream patch: https://lore.kernel.org/netdev/193d6cdf-d6c9-f9be-c36a-b2a7551d5fb6@mojatatu.com/

A flaw in the Linux Kernel found. Use after free in the net/sched classifiers (clsfw, clsu32 and clsroute) can happen because of mainline/net/sched/clsfw.c incorrect handling of the existing filter in .change method that leads to an extra unbindtcf call for the associated class and that allows that class to be removed while it's still used. These bugs can be used for a local privilege escalation.

Upstream patch: https://lore.kernel.org/netdev/193d6cdf-d6c9-f9be-c36a-b2a7551d5fb6@mojatatu.com/

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes: All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

A flaw in the Linux Kernel found. An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg() function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64

A flaw in the Linux Kernel found. If napi frags enabled and patch 363a5328f4b0 ("net: tun: fix bugs for oversize packet when napi frags enabled") not applied, then when local user try to send too large IPV6 packet (with big packet length), it can lead to out of bounds memory bug.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=363a5328f4b0

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105remove in drivers/media/pci/dm1105/dm1105.c.

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134finidev in drivers/media/pci/saa7134/saa7134-core.c.

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relayfilereadstartpos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

A use-after-free flaw was found in r592remove in drivers/memstick/host/r592.c in media access in Linux Kernel. This flaw could allow a local attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.

Refer: https://lore.kernel.org/lkml/CAPDyKFoV9aZObZ5GBm0U-UVeVkBNrAG-kH3BKoP4EXdYM4bw@mail.gmail.com/t/

A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.

The perfgroupdetach function did not check the event's siblings' attachstate before calling addeventtogroups(), but removeonexec made it possible to call listdelevent() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fd0815f632c24878e325821943edccc7fde947a2

A flaw in the Linux Kernel found. A heap out-of-bounds read vulnerability in the Linux Kernel traffic control (QoS) subsystem can be exploited to achieve local privilege escalation. The qfqchangeclass function does not properly limit the lmax variable which can lead to out-of-bounds read/write. If the TCAQFQLMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1 and as a result, it is possible to have an lmax value that exceeds QFQMINLMAX.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3037933448f60f9acb705997eae62013ecb81e0d

A vulnerability was found in comparenetdevandip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege.