In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfsattrfind in fs/ntfs/attrib.c.

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tsttimer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.

A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function securityinodealloc to fail with following call to function nilfsmdtdestroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

An out-of-bounds (OOB) memory access flaw was found in x25bind in net/x25/afx25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system's integrity and availability.

As .x25addr[] array comes from the user and is not necessarily NUL terminated. Using strnlen() instead of strlen() will prevent a read overflow problem.

A flaw was found in the Linux kernel's ext4unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI.

Last updated 29 November 2024

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.

Kernel panic (via skboverpanic) is encountered when sctp stack receive a malformed asconf chunks.

skboverpanic: text:ffffffffa01ea1c3 len:31056 put:30768 head:ffff88011bd81800 data:ffff88011bd81800 tail:0x7950 end:0x440 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:129! [...] Call Trace: <IRQ> [<ffffffff8144fb1c>] skbput+0x5c/0x70 [<ffffffffa01ea1c3>] sctpaddtochunk+0x63/0xd0 [sctp] [<ffffffffa01eadaf>] sctpprocessasconf+0x1af/0x540 [sctp] [<ffffffff8152d025>] ? readunlockbh+0x15/0x20 [<ffffffffa01e0038>] sctpsfdoasconf+0x168/0x240 [sctp] ...

A remote attacker could use this flaw to crash the system.

Acknowledgements:

This issue was discovered by Liu Wei of Red Hat.

drivers/scsi/mpt2sas/mpt2sasctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the ctldomptcommand and ctldiagreadbuffer functions.

Description of problem: While chasing a bug report involving a OS/2 server, I noticed the server sets pSMBr->CountHigh to a incorrect value even in case of normal writes. This results in 'nbytes' being computed wrongly and triggers a kernel BUG at mm/filemap.c. void ioviteradvance(struct ioviter i, sizet bytes) { BUGON(i->count < bytes); <--- BUG here Why the server is setting 'CountHigh' is not clear but only does so after writing 64k bytes. Though this looks like the server bug, the client side crash may not be acceptable. The workaround is to mask off high 16 bits if the number of bytes written as returned by the server is greater than the bytes requested by the client.

Upstream commit: http://git.kernel.org/linus/6513a81e9325d712f1bfb9a1d7b750134e49ff18 (v2.6.34-rc4)

Reported by Tavis Ormandy of Google Security Team. The root cause was determined to be a use-after-free of locked async file descriptors, and it is believed to have been introduced here: http://git.kernel.org/linus/233e70f4228e78eb2f80dc6650f65d3ae3dbf17c

Acknowledgements:

Red Hat would like to thank Tavis Ormandy of Google Security Team for reporting this issue.

The ext4decodeerror function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.

Description of problem: From 910123ba363623f15ffb5d05dd87bdf06d08c609 Mon Sep 17 00:00:00 2001 From: Akira Fujita <a-fujita.nec.com> Date: Sun, 6 Dec 2009 23:38:31 -0500 Subject: [PATCH] ext4: Fix insufficient checks in EXT4IOCMOVEEXT

This patch fixes three problems in the handling of the EXT4IOCMOVEEXT ioctl:

1. In current EXT4IOCMOVEEXT, there are read access mode checks for original and donor files, but they allow the illegal write access to donor file, since donor file is overwritten by original file data. To fix this problem, change access mode checks of original (r->r/w) and donor (r->w) files.

2. Disallow the use of donor files that have a setuid or setgid bits.

3. Call mntwantwrite() and mntdropwrite() before and after ext4moveextents() calling to get write access to a mount.

Signed-off-by: Akira Fujita <a-fujita.nec.com> Signed-off-by: "Theodore Ts'o" <tytso> --- fs/ext4/ioctl.c | 30 ++++++++++++++++++------------ fs/ext4/moveextent.c | 7 +++++++ 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 31e5ee0..b63d193 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -221,32 +221,38 @@ setversionout: struct file donorfilp; int err; + if (!(filp->fmode & FMODEREAD) || + !(filp->fmode & FMODEWRITE)) + return -EBADF; + if (copyfromuser(&me, (struct moveextent user )arg, sizeof(me))) return -EFAULT; + me.movedlen = 0; donorfilp = fget(me.donorfd); if (!donorfilp) return -EBADF; - if (!capable(CAPDACOVERRIDE)) { - if ((current->realcred->fsuid != inode->iuid) || - !(inode->imode & SIRUSR) || - !(donorfilp->fdentry->dinode->imode & - SIRUSR)) { - fput(donorfilp); - return -EACCES; - } + if (!(donorfilp->fmode & FMODEWRITE)) { + err = -EBADF; + goto mextout; } - me.movedlen = 0; + err = mntwantwrite(filp->fpath.mnt); + if (err) + goto mextout; + err = ext4moveextents(filp, donorfilp, me.origstart, me.donorstart, me.len, &me.movedlen); - fput(donorfilp); + mntdropwrite(filp->fpath.mnt); + if (me.movedlen > 0) + fileremovesuid(donorfilp); if (copytouser((struct moveextent )arg, &me, sizeof(me))) - return -EFAULT; - + err = -EFAULT; +mextout: + fput(donorfilp); return err; } diff --git a/fs/ext4/moveextent.c b/fs/ext4/moveextent.c index cad1e2e..82c415b 100644 --- a/fs/ext4/moveextent.c +++ b/fs/ext4/moveextent.c @@ -957,6 +957,13 @@ mextcheckarguments(struct inode originode, return -EINVAL; } + if (donorinode->imode & (SISUID|SISGID)) { + ext4debug("ext4 move extent: suid or sgid is set" + " to donor file [ino:orig %lu, donor %lu]\n", + originode->iino, donorinode->iino); + return -EINVAL; + } + / Ext4 move extent does not support swapfile / if (ISSWAPFILE(originode) || ISSWAPFILE(donorinode)) { ext4debug("ext4 move extent: The argument files should " -- 1.6.5.216.g5288a.dirty

Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.

Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was

commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes> Date: Tue Feb 10 21:25:53 2009 +0100

mac80211: RX aggregation: clean up stop session

and other parts were already present in the original

commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky> Date: Mon Jan 28 14:07:22 2008 +0200

mac80211: A-MPDU Tx add delBA from recipient support

The first problem is that I moved a BUGON before various checks -- thereby making it possible to hit. As the comment indicates, the BUGON can be removed since the ampduaction callback must already exist when the state is != IDLE.

The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARNON may happen with non-HT drivers, while the race opens only for HT drivers.

For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock

2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already.

Description of problem: ext4: avoid divide by zero when trying to mount a corrupted file system If sloggroupsperflex is greater than 31, then groupsperflex will overflow and cause a divide by zero error. This can cause kernel BUG if such a file system is mounted. Upstream commit: http://git.kernel.org/linus/503358ae01b70ce6909d19dd01287093f6b6271c

References: http://bugzilla.kernel.org/showbug.cgi?id=14287 http://secunia.com/advisories/37658

The collectrxframe function in drivers/isdn/hisax/hfcusb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.

Quote from the upstream commit: Debug registers may only be accessed from cpl 0. Unfortunately, vmx will code to emulate the instruction even though it was issued from guest userspace, possibly leading to an unexpected trap later.

Introduced in v2.6.30-rc1; Fixed in v2.6.32-rc1.

http://git.kernel.org/linus/0a79b009525b160081d75cef5dbf45817956acf2

Integer overflow in the kvmdevioctlgetsupportedcpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVMGETSUPPORTEDCPUID request to the kvmarchdevioctl function.

Quoting from upstream patch: On setting up the callback to the client, we attempt to use the same authentication flavor the client did. We find an rpc cred to use by calling rpcauthlookupcredcache(), which assumes that the given authentication flavor has a credentials cache. However, this is not required to be true--in particular, authnull does not use one. Instead, we should call the auth's lookupcred() method.

Without this, a client attempting to mount using nfsv4 and authnull triggers a null dereference.

The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1), fixed in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b.

Quoting from the upstream commit: Almost all r128's private ioctls require that the CCE state has already been initialised. However, most do not test that this has been done, and will proceed to dereference a null pointer. This may result in a security vulnerability, since some ioctls are unprivileged.

This adds a macro for the common initialisation test and changes all ioctl implementations that require prior initialisation to use that macro.

Also, r128doinitcce() does not test that the CCE state has not been initialised already. Repeated initialisation may lead to a crash or resource leak. This adds that test.

http://git.kernel.org/linus/7dc482dfeeeefcfd000d4271c4626937406756d7

Other references: http://secunia.com/advisories/36707/

Hi,

Description of problem:

execution of a particular program from the Arachne suite reliably causes a kernel panic due to a NULL-pointer dereference in nfs4proclock().

Version-Release number of selected component (if applicable):

2.6.18-164.2.1.el5

How reproducible:

always on NFSv4 mounted directories

Steps to Reproduce: 1. wget http://www.genoscope.cns.fr/externe/redhat/XMLMissingField 2. Save a copy on an NFSv4-mounted directory 3. Execute it Actual results:

Kernel panic

Expected results:

No panic

Additional info:

Console output:

Unable to handle kernel NULL pointer dereference at 0000000000000030 RIP: [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad PGD 1026eec067 PUD 1026f2f067 PMD 0 Oops: 0000 [1] SMP last sysfs file: /block/dm-1/range CPU 0 Modules linked in: ipmidevintf ipmisi ipmimsghandler nfs lockd fscache nfsacl sunrpc bonding ipv6 xfrmnalgo cryptoapi video hwmon backlight sbs i2cec button battery asusacpi acpimemhotplug ac joydev sg shpchp i2cnforce2 i2ccore forcedeth dmsnapshot dmzero dmmod satanv libata mptsas mptscsih mptbase scsitransportsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 4070, comm: XMLMissingField Not tainted 2.6.18-164.2.1.el5 #1 RIP: 0010:[<ffffffff8837b210>] [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad RSP: 0018:ffff810819bdbdd8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff810827c52088 RSI: 0000000000000006 RDI: ffff810819bdbe38 RBP: ffff81081a6dfdc0 R08: 0000000000000001 R09: ffff810819bdbd68 R10: ffff810819bdbd68 R11: 00000000000000d0 R12: ffff810827c52088 R13: 0000000000000000 R14: ffff810819a9b930 R15: 0000000000000006 FS: 00002b97d31fc7b0(0000) GS:ffffffff803c1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000030 CR3: 00000010268cb000 CR4: 00000000000006e0 Process XMLMissingField (pid: 4070, threadinfo ffff810819bda000, task ffff810827d6a7e0) Stack: 00000000000003e8 0000000000000000 ffff810819a9b930 ffffffff88373e4f 0000000000000000 0000000000000000 0000000000000000 0000000019a9ba40 ffff810819bdbe18 ffff810819bdbe18 0000000000000000 0000000000000000 Call Trace: [<ffffffff88373e4f>] :nfs:nfssyncinodewait+0x116/0x1db [<ffffffff8836a226>] :nfs:dosetlk+0x55/0x8c [<ffffffff80039e72>] fcntlsetlk+0x11e/0x273 [<ffffffff800b66fa>] auditsyscallentry+0x180/0x1b3 [<ffffffff8002e5bb>] sysfcntl+0x269/0x2dc [<ffffffff8005d28d>] tracesys+0xd5/0xe0

Code: 49 8b 45 30 4c 89 e6 4c 89 ef 45 8a 74 24 58 48 8b 40 18 48 RIP [<ffffffff8837b210>] :nfs:nfs4proclock+0x21f/0x3ad RSP <ffff810819bdbdd8> CR2: 0000000000000030 <0>Kernel panic - not syncing: Fatal exception

Also see http://www.spinics.net/linux/lists/linux-nfs/msg03357.html

The pollmodeio file for the megaraidsas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

The getrandomint function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

The eisaeepromread function in the parisc isa-eeprom component (drivers/parisc/eisaeeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.

cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and other versions before 2.6.31-rc6 allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames in which one frame omits an SSID Information Element (IE) and the subsequent frame contains an SSID IE, which triggers a NULL pointer dereference in the cmpies function. NOTE: a potential weakness in the ismesh function was also addressed, but the relevant condition did not exist in the code, so it is not a vulnerability.

Description of problem: Dan Walsh's blog post mentioned in the previous comment details selinux-policy part of the issue tracked via bug #512284. As noted in the the blog, selinux-policy provides a boolean - allowunconfinedmmaplow - which controls whether mmapminaddr restriction is applied to the process. This boolean, however, did not work as expected, as unconfinedt domain (default domain for logged-in unprivileged users) was always permitted to map low memory pages regardless of the boolean setting. This problem with the boolean is being fixed and the fix will be included in future selinux-policy updates in RHEL5 and Fedora (see Dan's blog for NVRs).

Few notes specific to Red Hat Enterprise Linux 5: Support for mmapminaddr sysctl was not included in the GA version of RHEL5. It was only added in kernel update in 5.2 (it first appeared upstream in 2.6.24). selinux-policy was, to avoid breaking applications needing low memory pages mapping on upgrade from 5.1 to 5.2, configured to allow mmapzero in unconfined domains and only disallow it in confined domains (e.g. various network facing services). In 5.3, allowunconfinedmmaplow boolean was added, but it's default value for targeted policy was changed to on, i.e. allowing mmapzero in all unconfined domains by default. This default boolean value is planned to remain unchanged in 5.4.

It should also be noted, that even with allowunconfinedmmaplow boolean set to off, it is still possible for unconfinedt user to transition to other domain that is permitted to mmapzero, as details in the Dan's blog post. Upstream discussion on how to best address this issue is still ongoing.

Eric's proposed patches moving mmapminaddr check out of security were submitted. If they are accepted upstream, mmapminaddr will be checked before LSM hooks are called. Security modules will only be consulted if mmapminaddr check has passed (e.g. when mmapminaddr is 0), so SELinux may still be able to restrict mapping of the low pages / zero page for confined domains and permit mapping in unconfined, even when mmapminaddr is 0.

Eric's patches with further discussion: http://patchwork.kernel.org/patch/36540/ http://patchwork.kernel.org/patch/36539/

Updated version: http://patchwork.kernel.org/patch/36650/ http://patchwork.kernel.org/patch/36649/

Further discussion of the proposed change: http://thread.gmane.org/gmane.linux.kernel.lsm/9075

mmapminaddr on SELinux and non-SELinux systems http://eparis.livejournal.com/606.html

Confining the unconfined. Oxymoron? http://danwalsh.livejournal.com/30084.html

Kbase: http://kbase.redhat.com/faq/docs/DOC-18042

The initposixtimers function in kernel/posix-timers.c in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (OOPS) or possibly gain privileges via a CLOCKMONOTONICRAW clocknanosleep call that triggers a NULL pointer dereference.

Description of problem: Reported by Tavis Ormandy and Julien Tinnes. The SOCKOPSWRAP macro from include/linux/net.h doesn't initialise the sendpage operation in the protoops structure correctly. Leading to a kernel NULL pointer dereference, and thus a local privilege escalation.

Acknowledgements:

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting this flaw.