Eric Biggers

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.18 Description: The vulnerability is related to a use-after-free error in the Linux kernel's aio component. This error occurs when the `aio poll wake()` function is called and the `POLLFREE` notification is not handled properly, allowing a use-after-free to occur if a `signalfd` or `binder fd` is polled with `aio poll` and the waitqueue gets freed. The issue is caused by the fact that `aio poll` does not handle `POLLFREE` notifications, unlike `eventpoll`. To fix this, a patch was applied to make `aio poll` handle `POLLFREE` in a deadlock-free way, taking advantage of the fact that freeing of the waitqueue is RCU-delayed. Recommendations: To resolve the issue, update the Linux kernel to a version that includes the fix for the use-after-free error in the aio component. Specifically, update to a version later than 4.18. Note: The provided input descriptions do not mention specific fixed versions or patchdays, so the recommendation is based on the information that the vulnerability was introduced in kernel v4.18.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the fs/aio component of the Linux kernel, where the first kiocb set cancel fn() argument may point at a struct kiocb that is not embedded inside struct aio kiocb. This can cause the req->ki ctx read to happen either before or after the IOCB AIO RW test, depending on the compiler. The problem is resolved by moving the req->ki ctx read to guarantee that the IOCB AIO RW test happens first. The vulnerability may allow an attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the f2fs file system in the Linux kernel, where an unused xattr space is not always zeroed, leading to potential security risks. When setting an xattr, the xattr list is explicitly null-terminated to eliminate the fragile assumption that the unused xattr space is always zeroed. This vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A memory leak issue has been identified in the Linux kernel, specifically in the ext4 file system. The leak occurs when processing on-disk mount options fails after memory allocation in the ext4 fs context. This issue is resolved by calling ext4 fc free() instead of kfree() directly. A reproducer is provided to demonstrate the issue, involving the creation of an ext4 file system, setting mount options, and scanning for memory leaks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a reference leak in the `asymmetric verify()` function of the Linux kernel's ima component. This leak occurs when the algorithm of a key is unknown. The exploitation of this issue may lead to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.13.10 **Description** The issue is related to incorrect synchronization in the KEYS subsystem of the Linux kernel, which can lead to a race condition. This can be exploited by local users through specially crafted system calls, potentially causing a denial of service or other unspecified impacts. **Recommendations** For Linux kernel versions prior to 4.13.10, update to version 4.13.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.13.7 **Description** The issue is related to errors in pointer dereferencing in the KEYS subsystem of the Linux kernel. It can be exploited by an attacker to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. The exploitation is possible through a crafted system call, specifically when using `add key` for a key that already exists but is uninstantiated. **Recommendations** For Linux kernel versions prior to 4.13.7, update to version 4.13.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the `add key` system call to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.13.5 **Description** The issue arises from the keyctl read key function in the Key Management subcomponent of the Linux kernel, which does not properly handle keys that are possessed but negatively instantiated. This oversight allows local users to trigger a denial of service, resulting in an OOPS and system crash, by executing a crafted KEYCTL READ operation. **Recommendations** For Linux kernel versions prior to 4.13.5, update to version 4.13.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 4.9.x before 4.9.1 **Description** The issue is related to the smbhash function in fs/cifs/smbencrypt.c, which interacts incorrectly with the CONFIG VMAP STACK option. This can allow local users to cause a denial of service, such as a system crash or memory corruption, by leveraging the use of more than one virtual page for a scatterlist. **Recommendations** For Linux kernel versions 4.9.x before 4.9.1, update to version 4.9.1 or later to resolve the issue.