Ryota Shiga

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** The issue is related to an improper input validation flaw in the eBPF subsystem of the Linux kernel. This flaw occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. As a result, an attacker with CAP BPF privileges may be able to escalate privileges and execute arbitrary code in the context of the kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.32 **Description** The issue exists due to insufficient input validation in the Core component of Oracle VM VirtualBox. Exploitation of this issue may allow an attacker to disclose protected information. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. **Recommendations** For versions prior to 6.1.32, update to version 6.1.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a kernel address leakage in the atomic cmpxchg's r0 aux reg of the BPF component. The implementation of BPF CMPXCHG has parameters including `old-val` and `new-val`, where BPF R0 is used as an auxiliary register for input and output. The verifier misses rejecting unprivileged programs where R0 contains a pointer as old value, allowing for kernel address leakage through brute-forcing, which can take approximately 16 seconds. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel version 5.14-rc3 **Description** This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of eBPF programs, resulting from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel. **Recommendations** For Linux Kernel version 5.14-rc3, consider disabling the handling of eBPF programs as a temporary workaround until a patch is available. Restrict access to the eBPF subsystem to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel’s io uring implementation, allowing an attacker with a local account to corrupt system memory, crash the system, or escalate privileges. The issue is related to a use-after-free vulnerability in the io uring subsystem, which can be exploited to gain elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to v5.13-rc4 Linux kernel versions prior to v5.12.4 Linux kernel versions prior to v5.11.21 Linux kernel versions prior to v5.10.37 **Description** The eBPF RINGBUF `bpf ringbuf reserve()` function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue allows an attacker to execute arbitrary code in the context of the kernel. **Recommendations** For Linux kernel versions prior to v5.13-rc4, update to v5.13-rc4 or later to fix the issue. For Linux kernel versions prior to v5.12.4, update to v5.12.4 or later to fix the issue. For Linux kernel versions prior to v5.11.21, update to v5.11.21 or later to fix the issue. For Linux kernel versions prior to v5.10.37, update to v5.10.37 or later to fix the issue.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** The issue is related to a double free privilege escalation vulnerability in the Linux Kernel Bluetooth CMTP module. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the CMTP module, resulting from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU versions up to and including 5.2.0 **Description** A race condition flaw was found in the 9pfs server implementation, allowing a malicious 9p client to cause a use-after-free error. This could potentially escalate privileges on the system, with the highest threat being to confidentiality, integrity, and system availability. **Recommendations** For QEMU versions up to and including 5.2.0, update to a version later than 5.2.0 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A use-after-free flaw was found in the io uring in Linux kernel, where a local attacker with user privilege could cause a denial of service problem on the system. The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** apport versions prior to 2.20.1-0ubuntu2.24 apport versions 2.20.9 prior to 2.20.9-0ubuntu7.16 apport versions 2.20.11 prior to 2.20.11-0ubuntu27.6 **Description** The issue exists due to insufficient checking of a shared resource's state in the apport error reporting service. This can allow an attacker to escalate privileges and execute arbitrary code. An attacker may exploit PID recycling to spawn a root process with the same PID as a crashed process, which can then be used to escalate privileges. **Recommendations** For apport versions prior to 2.20.1-0ubuntu2.24, update to version 2.20.1-0ubuntu2.24 or later. For apport versions 2.20.9 prior to 2.20.9-0ubuntu7.16, update to version 2.20.9-0ubuntu7.16 or later. For apport versions 2.20.11 prior to 2.20.11-0ubuntu27.6, update to version 2.20.11-0ubuntu27.6 or later. As a temporary workaround, consider restricting access to the apport service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** gdbus versions (affected versions not specified) apport versions (affected versions not specified) **Description** The issue is related to a privilege escalation in gdbus and an information disclosure vulnerability in the apport error reporting service. The apport vulnerability is caused by errors in the code and can be exploited through specially crafted D-Bus calls, allowing an attacker to read arbitrary files. **Recommendations** For gdbus, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For apport, at the moment, there is no information about a newer version that contains a fix for this vulnerability.