crypto: algifaead - Revert to operating out-of-place
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This issue affects SUSE Linux Enterprise Server: from 9e6d9d4601768c75fdb0bad3fbbe636e748939c2 before 9c294edb7085fb91650bc12233495a8974c5ff2d.
An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.
It was found that in Linux kernel when peeling off an association to the socket in another network namespace, all transports in this association are not to be rehashed and keep use the old key in hashtable. A kernel would miss removing transports from hashtable when closing the socket and all transports are being freed. Later on a use-after-free issue could be caused when looking up an association and dereferencing the transports.
References:
https://patchwork.ozlabs.org/patch/827077/
http://seclists.org/oss-sec/2017/q4/282
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=df80cd9b28b9ebaa284a41df611dbf3a2d05ca74
ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.
References:
http://mailman.alsa-project.org/pipermail/alsa-devel/2018-February/132026.html
https://marc.info/?l=alsa-devel&m=151859118611846&w=2
An upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d15d662e89fc667b90cd294b0eb45694e33144da
The tcpmssmanglepacket function in net/netfilter/xtTCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xtTCPMSS in an iptables action.
A local kernel crash on invalid USB device requiring the visor driver was reported. The treoattach() function of the [visor] driver, which is called during the driver initialization process, was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 554 #define COPYPORT(dest, src) \ 555 do { \ 556 int i; \ 557 \ 558 for (i = 0; i < ARRAYSIZE(src->readurbs); ++i) { \ 559 dest->readurbs[i] = src->readurbs[i]; \ / Possible Nullpointer-Dereference / 560 dest->readurbs[i]->context = dest; \ 561 dest->bulkinbuffers[i] = src->bulkinbuffers[i]; \ 562 } \ 563 dest->readurb = src->readurb; \ 564 dest->bulkinendpointAddress = src->bulkinendpointAddress;\ 565 dest->bulkinbuffer = src->bulkinbuffer; \ 566 dest->bulkinsize = src->bulkinsize; \ 567 dest->interruptinurb = src->interruptinurb; \ 568 dest->interruptinurb->context = dest; \ 569 dest->interruptinendpointAddress = \ 570 src->interruptinendpointAddress;\ 571 dest->interruptinbuffer = src->interruptinbuffer; \ 572 } while (0); 573 574 swapport = kmalloc(sizeof(swapport), GFPKERNEL); 575 if (!swapport) 576 return -ENOMEM; 577 COPYPORT(swapport, serial->port[0]); / no sanity-check! / 578 COPYPORT(serial->port[0], serial->port[1]); / no sanity-check! / 579 COPYPORT(serial->port[1], swapport); / no sanity-check! / ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283374
An upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Public via: http://seclists.org/bugtraq/2016/Mar/86
CVE-ID request and assignment: http://seclists.org/oss-sec/2016/q1/456 http://seclists.org/oss-sec/2016/q1/458
ISSUE DESCRIPTION =================
Xen PCI backend driver does not perform proper sanity checks on the device's state.
Which in turn allows the generic MSI code (called by Xen PCI backend) to be called incorrectly leading to hitting BUG conditions or causing NULL pointer exceptions in the MSI code.
To exploit this the guest can craft specific sequence of XENPCIOP operations which will trigger this.
Furthermore the frontend can also craft an continous stream of XENPCIOPenablemsi which will trigger an continous stream of WARN() messages triggered by the MSI code leading to the logging in the initial domain to exhaust disk space.
Lastly there is also missing check to verify whether the device has memory decoding enabled set at the start of the day leading the initial domain "accesses to the respective MMIO or I/O port ranges would - - on PCI Express devices - [which can] lead to Unsupported Request responses. The treatment of such errors is platform specific." (from XSA-120). Note that if XSA-120 'addendum' patch has been applied this particular sub-issue is not exploitable.
IMPACT ======
Malicious guest administrators can cause denial of service. If driver domains are not in use, the impact is a host crash.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
VULNERABLE SYSTEMS ==================
This bug affects systems using Linux as the driver domain, including non-disaggregated systems using Linux as dom0.
Linux versions v3.1 and onwards are vulnerable due to supporting PCI pass-through backend driver.
PV and HVM guests which have been granted access to physical PCI devices (PCI passthrough') can take advantage of this vulnerability.
Furthermore, the vulnerability is only applicable when the passed-through PCI devices are MSI-capable or MSI-X. (Most modern devices are).
MITIGATION ==========
Not using PCI passthrough for PV and HVM guests. Note that for HVM guests QEMU is used for PCI passthrough - however the toolstack sets up also the 'PV' PCI which the guest can utilize if it chooses to do so.
External References:
http://xenbits.xen.org/xsa/advisory-157.html
Acknowledgements:
Red Hat would like to thank the Xen project for reporting this issue.
Last updated 24 July 2024
GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
A vulnerability was found in the Linux kernel in function rdsincinfocopy of file net/rds/recv.c. The last field "flags" of object "minfo" is not initialized. Copying this object out may leak kernel stack data. Assign 0 to it to avoid leak.
Upstream bug:
https://patchwork.ozlabs.org/patch/629110/
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=4116def2337991b39919f3b448326e21c40e0dbb
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AFALG-based hash interface (CONFIGCRYPTOUSERAPIHASH) and the SHA-3 hash algorithm (CONFIGCRYPTOSHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
It was reported [1] that iptables can allow protocols that do not have a protocol handler kernel module loaded.
Given following iptables ruleset: -P FORWARD DROP -A FORWARD -m sctp --dport 9 -j ACCEPT -A FORWARD -p tcp --dport 80 -j ACCEPT -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
One would assume that this allows SCTP on port 9 and TCP on port 80. Unfortunately, if the SCTP conntrack module is not loaded, this allows all SCTP communication to pass through, i.e. -p sctp -j ACCEPT
[1]: http://www.spinics.net/lists/netfilter-devel/msg33430.html
Last updated 24 July 2024
A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.
An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution.
An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.
An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.
An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.
A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.