🛡️ LSN-0112-1 — linux

Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been

resolved: nfsd: fix use-after-free due to delegation race A delegation

break could arrive as soon as we've called vfs_setlease. A delegation break

runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the

delegation to del_recall_lru. If we then exit nfs4_set_delegation without

hashing the delegation, it will be freed as soon as the callback is done

with it, without ever being removed from del_recall_lru. Symptoms show up

later as use-after-free or list corruption warnings, usually in the

laundromat thread. I suspect aba2072f4523 'nfsd: grant read delegations to

clients holding writes' made this bug easier to hit, but I looked as far

back as v3.0 and it looks to me it already had the same problem. So I'm not

sure where the bug was introduced; it may have been there from the

beginning.)(CVE-2021-47506)

Jann Horn discovered that the watch_queue event notification subsystem in

the Linux kernel contained an out-of-bounds write vulnerability. A local

attacker could use this to cause a denial of service (system crash) or

escalate their privileges.)(CVE-2022-0995)

In the Linux kernel, the following vulnerability has been

resolved: net: atlantic: eliminate double free in error handling logic

Driver has a logic leak in ring data allocation/free, where aq_ring_free

could be called multiple times on same ring, if system is under stress and

got memory allocation error. Ring pointer was used as an indicator of

failure, but this is not correct since only ring data is

allocated/deallocated. Ring itself is an array member. Changing ring

allocation functions to return error code directly. This simplifies error

handling and eliminates aq_ring_free on higher layer.)(CVE-2023-52664)

In the Linux kernel, the following vulnerability has been

resolved: ceph: prevent use-after-free in encode_cap_msg() In

fs/ceph/caps.c, in encode_cap_msg(), 'use after free' error was caught by

KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies

before the refcount could be increment here, it was freed. In same file, in

'handle_cap_grant()' refcount is decremented by this line -

'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and

resource was freed by the latter line before the former line could

increment it. encode_cap_msg() is called by __send_cap() and __send_cap()

is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is

where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot

where the refcount must be increased to prevent 'use after free' error.)(CVE-2024-26689)

In the Linux kernel, the following vulnerability has been

resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break()

Skip sessions that are being teared down (status == SES_EXITING) to avoid

UAF.)(CVE-2024-35864)

In the Linux kernel, the following vulnerability has been

resolved: HID: core: zero-initialize the report buffer Since the report

buffer is used by all kinds of drivers in various ways, let's zero-

initialize it during allocation to make sure that it can't be ever used to

leak kernel memory via specially-crafted report.)(CVE-2024-50302)

In the Linux kernel, the following vulnerability has been

resolved: media: dvbdev: prevent the risk of out of memory access The

dvbdev contains a static variable used to store dvb minors. The behavior of

it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set,

dvb_register_device() won't check for boundaries, as it will rely that a

previous call to dvb_register_adapter() would already be enforcing it. On a

similar way, dvb_device_open() uses the assumption that the register

functions already did the needed checks. This can be fragile if some device

ends using different calls. This also generate warnings on static check

analysers like Coverity. So, add explicit guards to prevent potential risk

of OOM issues.)(CVE-2024-53063)

In the Linux kernel, the following vulnerability has been

resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock

sources The current USB-audio driver code doesn't check bLength of each

descriptor at traversing for clock descriptors. That is, when a device

provides a bogus descriptor with a shorter bLength, the driver might hit

out-of-bounds reads. For addressing it, this patch adds sanity checks to

the validator functions for the clock descriptor traversal. When the

descriptor length is shorter than expected, it's skipped in the loop. For

the clock source and clock multiplier descriptors, we can just check

bLength against the sizeof() of each descriptor type. OTOH, the clock

selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and

two more fields at its tail, hence those have to be checked in addition to

the sizeof() check.)(CVE-2024-53150)

In the Linux kernel, the following vulnerability has been

resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG:

KASAN: sl