Mingi Cho

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to the fixed version Description: A vulnerability in the Linux kernel has been resolved, specifically in the netem module. The issue arises from the `qdisc tree reduce backlog()` function not notifying the parent qdisc when the child qdisc becomes empty, unless the backlog of the child qdisc is reduced beforehand. This oversight leads to a missed opportunity to call `cops->qlen notify()`, resulting in a use-after-free (UAF) error in the case of the DRR (Deficit Round Robin) qdisc. The DRR relies on `->qlen notify()` to maintain its active list. Recommendations: For Linux Kernel versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider disabling the `qdisc tree reduce backlog()` function until a patch is available. Restrict access to the `netem` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.28 **Description** The issue is related to a race condition in the netfilter component of the Linux kernel, specifically in the nf tables module. This condition allows the rhashtable set gc to collect elements from anonymous sets with timeouts while they are being released from the commit path. The problem was originally reported by Mingi Cho in a different path in version 6.1.x with a pipapo set with low timeouts. To fix this, the dead flag is set for anonymous sets to skip async gc in this case. According to the plans, the abort path will be accelerated by releasing objects via a workqueue. **Recommendations** To resolve the issue, upgrade the Linux kernel to version 6.6.28 or later. As a temporary workaround, consider disabling the netfilter nf tables module until a patch is available. Restrict access to the vulnerable nf tables module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in the `nft chain lookup byid()` function, which failed to check whether a chain was active and if CAP NET ADMIN is in any user or network namespace. This vulnerability can be exploited to escalate privileges, potentially impacting the confidentiality, integrity, and availability of protected information. The vulnerability is associated with a race condition due to concurrent access to a resource. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the nf tables updtable function in the Linux kernel's netfilter tables API, which can lead to a NULL pointer dereference. This occurs when nf tables table enable returns an error, and nft trans destroy is called to free the transaction object. The nft trans destroy function calls list del, but since the transaction was never added to a list, the list head is all zeroes, resulting in the NULL pointer dereference. Exploitation of this issue could allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.2.5 macOS versions prior to 10.13.3 tvOS versions prior to 11.2.5 watchOS versions prior to 4.2.2 **Description** The issue involves the `Audio` component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted audio file. **Recommendations** For iOS versions prior to 11.2.5, update to version 11.2.5 or later. For macOS versions prior to 10.13.3, update to version 10.13.3 or later. For tvOS versions prior to 11.2.5, update to version 11.2.5 or later. For watchOS versions prior to 4.2.2, update to version 4.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.30 **Description** The issue is related to the `bfd section from shdr` function in the `elf.c` component of the Binary File Descriptor (BFD) library. It allows remote attackers to cause a denial of service, resulting in a segmentation fault, via a large attribute section. This is due to insufficient input validation. **Recommendations** For GNU Binutils version 2.30, consider applying a patch or fix that addresses the insufficient input validation in the `bfd section from shdr` function to prevent denial of service attacks. As a temporary workaround, consider restricting the size of attribute sections to prevent large sections from causing a segmentation fault.

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29.1 Description: The issue is related to the load debug section function in the readelf.c component of GNU Binutils, which is associated with a buffer overflow in memory. This can be exploited by a remote attacker using a specially crafted ELF file, potentially allowing access to confidential data, disrupting data integrity, and causing a denial of service through invalid memory access and application crash. Recommendations: For GNU Binutils version 2.29.1, consider restricting the use of the load debug section function until a patch is available. As a temporary workaround, avoid processing ELF files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29.1 Description: The issue is related to the `pe bfd read buildid` function in the `peicode.h` component of the Binary File Descriptor (BFD) library. It does not validate size and offset values in the data dictionary, allowing remote attackers to cause a denial of service, such as a segmentation violation and application crash, or possibly have other unspecified impacts via a crafted PE file. The vulnerability is also associated with an integer overflow, which can be exploited by a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted PE file. Recommendations: For GNU Binutils version 2.29.1, consider disabling the `pe bfd read buildid` function as a temporary workaround until a patch is available. Restrict access to the `peicode.h` component to minimize the risk of exploitation. Avoid using the vulnerable function with untrusted PE files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.