A flaw was found in the bash functionality that evaluates specially formatted environment variables passed to it from another environment. An attacker could use this feature to override or bypass restrictions to the environment to execute shell commands before restrictions have been applied. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
Acknowledgements:
Red Hat would like to thank Stephane Chazelas for reporting this issue.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
Last updated 24 July 2024
Customer has a repeatable panic in infinband code. In cmworkhandler (the one in cm.c, not iwcm.c) the cmwork structure is retrieved from the workstruct, and the attempt to dereference its madrecvwc pointer causes the crash, because the pointer has been incremented by one.
vmcores are on megatron.gsslab.rdu.redhat.com in /cores/20101108125468/work and /cores/20101108125467/work
Acknowledgements:
Red Hat would like to thank Jens Kuehnel for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
In ibuverbspollcq() code there is a potential integer overflow if userspace passes in a large cmd.ne. The calls to kmalloc() would allocate smaller buffers than intended, leading to memory corruption. There iss also an information leak if resp wasn't all used. Unprivileged userspace may call this function, although only if an RDMA device that uses this function is present.
Fix this by copying CQ entries one at a time, which avoids the allocation entirely, and also by moving this copying into a function that makes sure to initialize all memory copied to userspace.
Upstream commit: http://git.kernel.org/linus/7182afea8d1afd432a17c18162cc3fd441d0da93
A flaw was found in the linux kernels implementation of DCCP protocol in which a an application making a DCCP connection over IPV6 could crash a remote (or local) system. When attempting to send a DCCP reset packet, the system will incorrectly create the packet header and while updating the SNMP counters for this condition crash the kernel. The remote system would need to have both an application running as a DCCP server and have an IPV6 address routable.
This can result in the system crash or denial of service.
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=f53dc67c5e7babafe239b93a11678b0e05bead51