A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmapnetlblimport' routine. While processing the CIPSO restricted bitmap tag in the 'cipsov4parsetagrbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.
A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.
A malicious user or buggy application can inject code and trigger an infinite loop in inetdiagbcaudit()
Also make sure each instruction is aligned on 4 bytes boundary, to avoid unaligned accesses.
http://thread.gmane.org/gmane.linux.network/197206/focus=197386 http://patchwork.ozlabs.org/patch/100857/
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
A signedness issue has been found in nextpidmap() function when the "last" parameter is negative as nextpidmap() just quietly accepted whatever "last" pid that was passed in, which is not all that safe when one of the users is /proc.
Setting fpos to negative value when accessing /proc via readdir()/getdents() resulted in sign extension of this value when map pointer was being constructed.
This later lead to #GP becasue the final pointer was not cannonical (x8664).
map = &pidns->pidmap[(last + 1)/BITSPERPAGE]; ffffffff810ac3b4: 48 63 f6 movslq %esi,%rsi <- sign extension (fpos+-) ffffffff810ac3b7: 81 e2 ff 7f 00 00 and $0x7fff,%edx ffffffff810ac3bd: 48 c1 ee 0f shr $0xf,%rsi ffffffff810ac3c1: 48 c1 e6 04 shl $0x4,%rsi ffffffff810ac3c5: 48 8d 5c 37 08 lea 0x8(%rdi,%rsi,1),%rbx ... if (unlikely(!map->page)) ffffffff810ac3cc: 48 8b 7b 08 mov 0x8(%rbx),%rdi <- #GP
Only x8664 architecture seems to be vulnerable to this particular issue (tested ppc64, s390x, ia64).
Reference: http://groups.google.com/group/fa.linux.kernel/browsethread/thread/93c1088451fd3522/4a28ecb7f755a88d?#4a28ecb7f755a88d
Upstream commit: http://git.kernel.org/linus/c78193e9 http://git.kernel.org/linus/d8bdc59f
Acknowledgements:
Red Hat would like to thank Robert Swiecki for reporting this issue.
Integer overflow in the agpgenericinsertmemory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOCBIND agpioctl ioctl call.