🛡️ OESA-2025-1095 — kernel (CVE-2023-52480 +39 more)

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix race condition between session lookup and expire

Thread A + Thread B

ksmbd_session_lookup | smb2_sess_setup

sess = xa_load |

|

| xa_erase(&conn->sessions, sess->id);

|

| ksmbd_session_destroy(sess) --> kfree(sess)

|

// UAF! |

sess->last_active = jiffies |

+

This patch add rwsem to fix race condition between ksmbd_session_lookup

and ksmbd_expire_session.(CVE-2023-52480)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix connection failure handling

In case immediate MPA request processing fails, the newly

created endpoint unlinks the listening endpoint and is

ready to be dropped. This special case was not handled

correctly by the code handling the later TCP socket close,

causing a NULL dereference crash in siw_cm_work_handler()

when dereferencing a NULL listener. We now also cancel

the useless MPA timeout, if immediate MPA request

processing fails.

This patch furthermore simplifies MPA processing in general:

Scheduling a useless TCP socket read in sk_data_ready() upcall

is now surpressed, if the socket is already moved out of

TCP_ESTABLISHED state.(CVE-2023-52513)

In the Linux kernel, the following vulnerability has been resolved:

PM / devfreq: Fix buffer overflow in trans_stat_show

Fix buffer overflow in trans_stat_show().

Convert simple snprintf to the more secure scnprintf with size of

PAGE_SIZE.

Add condition checking if we are exceeding PAGE_SIZE and exit early from

loop. Also add at the end a warning that we exceeded PAGE_SIZE and that

stats is disabled.

Return -EFBIG in the case where we don't have enough space to write the

full transition table.

Also document in the ABI that this function can return -EFBIG error.(CVE-2023-52614)

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad7091r: Allow users to configure device events

AD7091R-5 devices are supported by the ad7091r-5 driver together with

the ad7091r-base driver. Those drivers declared iio events for notifying

user space when ADC readings fall bellow the thresholds of low limit

registers or above the values set in high limit registers.

However, to configure iio events and their thresholds, a set of callback

functions must be implemented and those were not present until now.

The consequence of trying to configure ad7091r-5 events without the

proper callback functions was a null pointer dereference in the kernel

because the pointers to the callback functions were not set.

Implement event configuration callbacks allowing users to read/write

event thresholds and enable/disable event generation.

Since the event spec structs are generic to AD7091R devices, also move

those from the ad7091r-5 driver the base driver so they can be reused

when support for ad7091r-2/-4/-8 be added.(CVE-2023-52627)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix potential context UAFs

gem_context_register() makes the context visible to userspace, and which

point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl.

So we need to ensure that nothing uses the ctx ptr after this. And we

need to ensure that adding the ctx to the xarray is the *last* thing

that gem_context_register() does with the ctx pointer.

[tursulin: Stable and fixes tags add/tidy.]

(cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)(CVE-2023-52913)

A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.

(CVE-2024-24857)

A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.

(CVE-2024-24859)

In the Linux kernel, the following vulnerability has been resolved:

xhci: handle isoc Babble and Buffer Overrun events properly

xHCI 4.9 explicitly forbids assuming that the xHC has released its

ownership of a multi-TRB TD when it reports an error on one of the

early TRBs. Yet the driver makes such assumption and releases the TD,

allowing the remaining TRBs to be freed or overwritten by new TDs.

The xHC should also report completion of the final TRB due to its IOC

flag being set by us, regardless of prior errors. This event cannot

be recognized if the TD has already been freed earlier, resulting in

"Transfer event TRB DMA ptr not part of current TD"