Dmitry Vyukov

**Name of the Vulnerable Software and Affected Versions** Abseil versions prior to commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 Abseil versions prior to 20230802.1-4ubuntu1.2 Abseil versions prior to 0~20200923.3-2+deb11u1 **Description** Abseil-cpp contains a heap buffer overflow issue. The `sized constructors`, `reserve()`, and `rehash()` methods of `absl::{flat,node}hash{set,map}` did not enforce a limit on the size of their input argument. This allowed a malicious actor to provide a large size, causing an integer overflow when calculating the container's backing store size, leading to an out-of-bounds memory write. Subsequent access to the container could also result in out-of-bounds memory access. The issue could potentially allow an attacker to cause a denial of service or memory corruption. **Recommendations** Upgrade to a version past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1. Upgrade to version 20230802.1-4ubuntu1.2. Upgrade to version 0~20200923.3-2+deb11u1.

**Nome do Software Vulnerável e Versões Afetadas** Versões do kernel Linux anteriores à 6.13.0-rc7 **Descrição** Um problema de use-after-free foi identificado no kernel Linux, especificamente no sistema de arquivos btrfs. Isso ocorre ao tentar ingressar em uma transação abortada, onde o campo 'aborted' é lido após desbloquear fs info->trans lock e sem manter nenhuma contagem de referência extra sobre ele. Isso permite que uma tarefa concorrente que está abortando a transação libere a transação antes que o campo 'aborted' seja lido, resultando em um use-after-free. O problema foi relatado por syzbot e Dmitry, com stack traces fornecidos pelo KASAN. **Recomendações** Para resolver este problema, atualize para uma versão do kernel Linux que inclua a correção para este problema de use-after-free. Como solução temporária, considere restringir o acesso ao sistema de arquivos btrfs até que um patch esteja disponível.

**Nome do Software Vulnerável e Versões Afetadas** Kernel Linux (versões afetadas não especificadas) **Descrição** Foi identificada uma vulnerabilidade no kernel Linux, relacionada a uma leitura fora dos limites durante a consulta no estado xfrm. O problema surge quando operações de consulta e redimensionamento são executadas em paralelo, e as funções de hash podem observar um valor de hmask que é muito grande para o novo array hlist. Isso se deve ao seqlock xfrm state hash generation garantir uma nova tentativa, mas não impedir que as funções de hash acessem um valor de hmask inconsistente. A vulnerabilidade pode ser explorada quando a atualização do state bydst não está devidamente sincronizada com a função de consulta. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Kernel do Linux (versões afetadas não especificadas) **Descrição** Foi identificada uma falha do tipo “use-after-free” no `qdisc graft`, localizado em `net/sched/sch api.c`, no kernel do Linux, devido a um problema de corrida de acesso. Essa falha leva a um problema de negação de serviço. A vulnerabilidade pode ser explorada para causar uma negação de serviço. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Kernel do Linux (versões afetadas não especificadas) **Descrição** O problema está relacionado a uma desreferência de ponteiro nulo no componente tipc do kernel do Linux. Especificamente, a função `tipc aead init()` está vulnerável, e sua exploração pode levar a uma negação de serviço. O problema surge porque `kmemdup` pode retornar um ponteiro nulo, que não é verificado, resultando na desreferência de uma chave nula posteriormente em `tipc crypto key xmit`. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Kernel do Linux (versões afetadas não especificadas) **Descrição** O problema está relacionado ao tratamento do hrtimer no módulo mac80211-hwsim. Quando o temporizador dispara com atraso devido ao agendamento da vCPU, ele tenta rearmar o temporizador no próximo prazo, que pode já ter passado. Esse comportamento é incorreto e pode causar travamentos. A abordagem correta é alinhar os beacons ao TBTT (Target Beacon Transmission Time) e retomar no ponto atual em caso de atraso. O código foi alterado para usar `hrtimer forward now()` a fim de garantir que o próximo disparo do temporizador ocorra no próximo ponto de intervalo após o tempo atual. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.14.8 **Description** The issue allows attackers to obtain potentially sensitive information from kernel memory. This is related to a write mmio stack-based out-of-bounds read in the KVM implementation, specifically in the files arch/x86/kvm/x86.c and include/trace/events/kvm.h. **Recommendations** For Linux kernel versions prior to 4.14.8, update to version 4.14.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.13.5 **Description** The issue concerns the x86/fpu subsystem in the Linux kernel, which does not correctly handle attempts to set reserved bits in the xstate header via the `ptrace()` or `rt sigreturn()` system call when a processor supports the xsave feature but not the xsaves feature. This allows local users to read the FPU registers of other processes on the system. **Recommendations** For Linux kernel versions prior to 4.13.5, update to version 4.13.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ptrace()` and `rt sigreturn()` system calls to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 4.13-rc1 through 4.13-rc6 **Description** The issue is related to a NULL pointer dereference in the Linux kernel, specifically in the net/ipv4/route.c file. This allows local users to cause a denial of service or possibly have other unspecified impacts via crafted system calls. The problem is associated with errors in pointer handling. **Recommendations** For Linux kernel versions 4.13-rc1 through 4.13-rc6, consider applying a patch that fixes the NULL pointer dereference issue in the net/ipv4/route.c file to prevent local users from causing a denial of service or other potential impacts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.10.2 **Description** A race condition exists in the Linux kernel, allowing local users to cause a denial of service, such as a system crash, via crafted system calls. This issue is related to incorrect interaction between `put ucounts` and `get ucounts` due to certain decrement behavior. **Recommendations** For Linux kernel versions prior to 4.10.2, update to version 4.10.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.9.13 **Description** The issue is related to the improper management of lock dropping by the `hashbin delete` function in the Linux kernel, which can be exploited by local users to cause a denial of service (deadlock) through crafted operations on IrDA devices. **Recommendations** For Linux kernel versions prior to 4.9.13, update to version 4.9.13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.9.11 **Description** The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and soft lockup. This can be achieved via vectors involving a TCP packet with the URG flag. The `tcp splice read` function in `net/ipv4/tcp.c` is the vulnerable component. **Recommendations** For Linux kernel versions prior to 4.9.11, update to version 4.9.11 or later to resolve the issue. As a temporary workaround, consider restricting the handling of TCP packets with the URG flag to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.9.8 **Description** The issue is related to errors in resource management in the `nested vmx check vmptr` function of the Linux operating system. This can be exploited by a local attacker to cause a denial of service, specifically through memory consumption. The `nested vmx check vmptr` function in the Linux kernel improperly emulates the VMXON instruction, allowing KVM L1 guest OS users to cause a denial of service by leveraging the mishandling of page references. **Recommendations** For Linux kernel versions prior to 4.9.8, update to version 4.9.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the `nested vmx check vmptr` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.9.4 **Description** The issue allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. **Recommendations** For Linux kernel versions prior to 4.9.4, update to version 4.9.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.9 **Description** The issue is related to the netfilter subsystem in the Linux kernel, which mishandles IPv6 reassembly. This can be exploited by local users via a crafted application that makes socket, connect, and writev system calls, potentially leading to a denial of service (integer overflow, out-of-bounds write, and GPF) or other unspecified impacts. **Recommendations** For Linux kernel versions prior to 4.9, update to version 4.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.8.12 **Description** The issue allows guest OS users to gain host OS privileges or cause a denial of service, resulting in an out-of-bounds array access and host OS crash, via a crafted interrupt request when I/O APIC is enabled. This is related to the files arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h. **Recommendations** For Linux kernel versions prior to 4.8.12, update to version 4.8.12 or later to resolve the issue. As a temporary workaround, consider disabling I/O APIC to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.8.12 **Description** The issue allows local users to obtain sensitive information from kernel stack memory via a crafted application due to improper initialization of Code Segment (CS) in certain error cases. **Recommendations** For versions prior to 4.8.12, update to version 4.8.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.6.6 **Description** A race condition exists in the get task ioprio function, allowing local users to potentially gain privileges or cause a denial of service through a crafted ioprio get system call. This issue can lead to a use-after-free scenario. **Recommendations** For Linux kernel versions prior to 4.6.6, update to version 4.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ioprio get system call to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.5.2 **Description** The issue is related to a use-after-free vulnerability in the ` sys recvmmsg` function, located in the net/socket.c file of the Linux kernel. This vulnerability can be exploited by remote attackers to execute arbitrary code through vectors involving a recvmmsg system call that is mishandled during error processing. **Recommendations** For Linux kernel versions prior to 4.5.2, update to version 4.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the recvmmsg system call to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.4.2 **Description** The issue allows local users to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This occurs when a crafted application does not supply a key, related to the `lrw crypt` function. **Recommendations** For Linux kernel versions prior to 4.4.2, update to version 4.4.2 or later to resolve the issue.