A flaw was found in glibc. An integer overflow in the implementation of the posixmemalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

References: https://sourceware.org/bugzilla/showbug.cgi?id=22343

Patch: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8e448310d74b283c5cd02b9ed7fb997b47bf9b22

A race condition in perfeventopen() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the credguardmutex) are held during the ptracemayaccess() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perfeventalloc() actually attaches to it, allowing an attacker to bypass the ptracemayaccess() check and the perfeventexittask(current) call that is performed in installexeccreds() during privileged execve() calls.