In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Zero out sring pointers on unmap

If xenvifmapfrontenddatarings() fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings() which keeps the ring pointers unchanged. xenvifconnectdata()'s cleanup path calls xenvifdisconnectqueue() which in turn calls xenvifunmapfrontenddatarings() again, which will attempt to unmap the pointers a second time.

Zero out the ring pointers after they are unmapped to avoid this issue.

This is XSA-532

In the Linux kernel, the following vulnerability has been resolved:

xen-netback: Fix XenBus connection failure cleanup

xenvifgetstats and xenvifgetethtoolstats capture vif->numqueues under rcureadlock. We need to unpublish vif->numqueues before synchronizenet to ensure that readers that come afterwards will not read a non-zero vif->numqueues and attempt to access invalid queues.

This is the same cleanup algorithm as used in backenddisconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect").

This is XSA-531

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

In the Linux kernel, the following vulnerability has been resolved:

ipv4: free inetopt and ireqopt after an RCU grace period

tcpv4synrecvsock() transfers ownership of ireq->ireqopt to the child socket (newinet->inetopt) without copying it.

Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcpcheckreq(). tcpv4sendsynack() and inetcskroutereq() read ireq->ireqopt under rcureadlock() only, and ipbuildandsendpkt() and ipoptionsbuild() then read opt->optlen twice.

Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inetcskreqskqueuedrop() calls timerdeletesync() before the child can be freed.

Since commit 079096f103fa ("tcp/dccp: install synrecv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCKRCUFREE, and inetsockdestruct() frees inetopt with a plain kfree(), leading to a use-after-free in ipoptionsbuild().

A similar issue exists with request socket migration (net.ipv4.tcpmigratereq=1, or a BPFSKREUSEPORTSELECTORMIGRATE program). reqsktimerhandler() clones the request socket with inetreqskclone(), so that the old request socket and its clone share the same ireqopt, then reqskmigratereset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcpv4synrecvsock()) when the clone is freed, and tcpv4reqskdestructor() also uses a plain kfree().

Readers already use RCU, and other paths replacing inetopt (doipsetsockopt(), cipsov4socksetattr()...) already use kfreercu(). Use kfreercu() in inetsockdestruct() and tcpv4reqskdestructor() as well.

IPv6 is not affected by the first issue, because tcpv6synrecvsock() duplicates the options. tcpv6reqskdestructor() has the same migration issue with ipv6opt, which is only set by CALIPSO. This will be addressed in a separate patch.

In removewaiter of rtmutex.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.