Anatoly Trosinenko

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a buffer overflow in the NFSD component of the Linux kernel. If a client sends a READDIR count argument that is too small, the buffer size calculation results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect, and NFSD has never checked the READDIR count argument. The problem was exposed when entry encoding changed, affecting the pointer arithmetic in xdr reserve space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request, and there are no unit tests that exercise the behavior of READDIR at the lower bound of @count values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU version 4.2.0 **Description** The issue is related to a buffer data boundary operation overflow in QEMU, which can be exploited to access confidential data, compromise data integrity, and cause a denial of service. Specifically, the `hw/pci/msix.c` file in QEMU allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. **Recommendations** For QEMU version 4.2.0, consider restricting access to the `hw/pci/msix.c` file or the msi-x mmio operation to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.4.7 through 5.4.28 Linux kernel versions 5.5.0 through 5.5.13 Linux kernel versions 5.6.0 through 5.6.0 **Description** The vulnerability is related to the bpf verifier in the Linux kernel, which did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This issue affects the Linux 5.4 stable series and newer versions. The vulnerability can be exploited to escalate privileges, allowing an attacker to gain root access. A working exploit exists but has not been publicly released. The vulnerability is present in the eBPF subsystem, which allows running handlers for tracing, analyzing subsystems, and managing traffic within the kernel. **Recommendations** For Linux kernel versions 5.4.7 through 5.4.28, update to version 5.4.29 or later. For Linux kernel versions 5.5.0 through 5.5.13, update to version 5.5.14 or later. For Linux kernel versions 5.6.0 through 5.6.0, update to version 5.6.1 or later. As a temporary workaround, consider restricting access to the eBPF subsystem to minimize the risk of exploitation.