In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix potential OOB access in audio mixer handling

In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixerindex() and sumindex()).

As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]'

After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field.

This patch addresses those OOB accesses by adding the proper initializations of the loop indices.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ac97: fix a double free in sndac97controllerregister()

If ac97addadapter() fails, putdevice() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idralloc() fails and in ac97adapterrelease() to do the cleanup.

Found by code review.

ALSA: usb-mixer: us16x08: validate meter packet indices

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb: m920x: Fix a potential memory leak in m920xi2cxfer()

'read' is freed when it is known to be NULL, but not when a read error occurs.

Revert the logic to avoid a small leak, should a m920xread() call fail.

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds

When we run syzkaller we get below Out of Bound. "KASAN: slab-out-of-bounds Read in regcacheflatread"

Below is the backtrace of the issue:

dumpbacktrace+0x0/0x4c8 showstack+0x34/0x44 dumpstacklvl+0xd8/0x118 printaddressdescription+0x30/0x2d8 kasanreport+0x158/0x198 asanreportload4noabort+0x44/0x50 regcacheflatread+0x10c/0x110 regcacheread+0xf4/0x180 regmapread+0xc4/0x278 regmapupdatebits+0x130/0x290 regmapupdatebitsbase+0xc0/0x15c sndsoccomponentupdatebits+0xa8/0x22c sndsoccomponentwritefield+0x68/0xd4 txmacrodigitalmute+0xec/0x140

Actually There is no need to have decimator with 32 bits. By limiting the variable with short type u8 issue is resolved.

In the Linux kernel, the following vulnerability has been resolved:

ACPI: EC: Fix oops when removing custom query handlers

When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module holding the callback function was already unloaded.

Fix this by flushing the EC query workqueue when removing custom query handlers.

Tested on a Acer Travelmate 4002WLMi

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hcisync: Avoid use-after-free in dbg for hciremoveadvmonitor()

KASAN reports that there's a use-after-free in hciremoveadvmonitor(). Trawling through the disassembly, you can see that the complaint is from the access in btdevdbg() under the HCIADVMONITOREXTMSFT case. The problem case happens because msftremovemonitor() can end up freeing the monitor structure. Specifically: hciremoveadvmonitor() -> msftremovemonitor() -> msftremovemonitorsync() -> msftlecancelmonitoradvertisementcb() -> hcifreeadvmonitor()

Let's fix the problem by just stashing the relevant data when it's still valid.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hcicore: lookup hciconn on RX path on protocol side

The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not concurrently modified/deleted. This locking appears to be leftover from before connhash started using RCU commit bf4c63252490b ("Bluetooth: convert conn hash to RCU") and not clear if it had purpose since then.

Currently, there are code paths that delete hciconn from elsewhere than the ordered hdev->workqueue where the RX work runs in. E.g. commit 5af1f84ed13a ("Bluetooth: hcisync: Fix UAF on hciabortconnsync") introduced some of these, and there probably were a few others before it. It's better to do the locking so that even if these run concurrently no UAF is possible.

Move the lookup of hciconn and associated socket-specific conn to protocol recv handlers, and do them within a single critical section to cover hciconn usage and lookup.

syzkaller has reported a crash that appears to be this issue:

[Task hdev->workqueue] [Task 2] hcidisconnectallsync l2caprecvacldata(hcon) hciconnget(hcon) hciabortconnsync(hcon) hcidevlock hcidevlock hciconndel(hcon) v-------------------------------- hcidevunlock hciconnput(hcon) conn = hcon->l2capdata (UAF)

In the Linux kernel, the following vulnerability has been resolved:

hfs: validate record offset in hfsplusbmapalloc

hfsplusbmapalloc can trigger a crash if a record offset or length is larger than nodesize

[ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplusbmapalloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary) [ 15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace: [ 15.266168] <TASK> [ 15.266169] dumpstacklvl+0x53/0x70 [ 15.266173] printreport+0xd0/0x660 [ 15.266181] kasanreport+0xce/0x100 [ 15.266185] hfsplusbmapalloc+0x887/0x8b0 [ 15.266208] hfsbtreeincheight.isra.0+0xd5/0x7c0 [ 15.266217] hfsplusbrecinsert+0x870/0xb00 [ 15.266222] hfsplusextwriteextent+0x428/0x570 [ 15.266225] hfsplusextcacheextent+0x5e/0x910 [ 15.266227] hfsplusextreadextent+0x1b2/0x200 [ 15.266233] hfsplusfileextend+0x5a7/0x1000 [ 15.266237] hfsplusgetblock+0x12b/0x8c0 [ 15.266238] blockwritebeginint+0x36b/0x12c0 [ 15.266251] blockwritebegin+0x77/0x110 [ 15.266252] contwritebegin+0x428/0x720 [ 15.266259] hfspluswritebegin+0x51/0x100 [ 15.266262] contwritebegin+0x272/0x720 [ 15.266270] hfspluswritebegin+0x51/0x100 [ 15.266274] genericperformwrite+0x321/0x750 [ 15.266285] genericfilewriteiter+0xc3/0x310 [ 15.266289] kernelwriteiter+0x2fd/0x800 [ 15.266296] dumpuserrange+0x2ea/0x910 [ 15.266301] elfcoredump+0x2a94/0x2ed0 [ 15.266320] vfscoredump+0x1d85/0x45e0 [ 15.266349] getsignal+0x12e3/0x1990 [ 15.266357] archdosignalorrestart+0x89/0x580 [ 15.266362] irqentryexittousermode+0xab/0x110 [ 15.266364] asmexcpagefault+0x26/0x30 [ 15.266366] RIP: 0033:0x41bd35 [ 15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f [ 15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [ 15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK>

When calling hfsplusbmapalloc to allocate a free node, this function first retrieves the bitmap from header node and map node using node->page together with the offset and length from hfsbreclenoff

len = hfsbreclenoff(node, 2, &off16); off = off16;

off += node->pageoffset; pagep = node->page + (off >> PAGESHIFT); data = kmaplocalpage(pagep);

However, if the retrieved offset or length is invalid(i.e. exceeds nodesize), the code may end up accessing pages outside the allocated range for this node.

This patch adds proper validation of both offset and length before use, preventing out-of-bounds page access. Move isbnodeoffsetvalid and checkandcorrectrequestedlength to hfsplusfs.h, as they may be required by other functions.

A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit.

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.

Stack-based buffer overflow in the aclget function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

DISPUTED MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw in an NVIDIA driver, which has unknown impact and attack vectors. NOTE: see CVE-2012-3105 for the related MFSA 2012-34 issue in Mozilla products.

Multiple cross-site request forgery (CSRF) vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on IRIX, Snare Epilog 1.5.3 and earlier on Windows, and Snare Epilog 1.2 and earlier on UNIX allow remote attackers to hijack the authentication of administrators for requests that (1) change the password or (2) change the listening port.

Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.

Unspecified vulnerability in the VBoxNetAdpCtl configuration tool in Sun VirtualBox 3.0.x before 3.0.8 on Solaris x86, Linux, and Mac OS X allows local users to gain privileges via unknown vectors.

Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3587.

Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption, a different vulnerability than CVE-2009-3588.

Description of problem: dosigaltstack: avoid copying 'stackt' as a structure to user space Ulrich Drepper correctly points out that there is generally padding in the structure on 64-bit hosts, and that copying the structure from kernel to user space can leak information from the kernel stack in those padding bytes. Avoid the whole issue by just copying the three members one by one instead, which also means that the function also can avoid the need for a stack frame. This also happens to match how we copy the new structure from user space, so it all even makes sense.

Upstream commit: http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856

The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument.

AVG Anti-Virus for Linux 7.5.51, and possibly earlier, allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via a malformed UPX compressed file, which triggers memory corruption.

Multiple integer overflows in the scanning engine in Bitdefender for Linux 7.60825 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed (1) NeoLite and (2) ASProtect packed PE file.

Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via vectors related to activation of a shortcut.