Seunghun Han

**Name of the Vulnerable Software and Affected Versions:** Linux Kernel versions 4.12.0-rc4-next-20170608+ and earlier **Description:** The Linux kernel contains an ACPICA cache leak in ACPI early abort cases. Specifically, the “Acpi-Parse” and “Acpi-parse ext” caches were found to be leaked due to the use of the SLAB NEVER MERGE flag in the `kmem cache create()` function. This occurs when the size of cache objects is the same as the slab cache size, leading to a merge of the “Acpi-State” cache. **Recommendations:** Linux Kernel versions prior to 4.12.0-rc4-next-20170608+ should be updated.

**Name of the Vulnerable Software and Affected Versions** Trusted Platform Module (TPM) 2.0 (affected versions not specified) **Description** The issue affects BIOS firmware producers who interpret a certain portion of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0 specification in a specific way. It involves an abnormal case not being handled properly by the firmware during S3 sleep, which can clear TPM 2.0 and allow local users to overwrite static PCRs of TPM. This can neutralize the security features of TPM, such as seal/unseal and remote attestation. The vulnerability is related to errors in security settings and can impact the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.15.7 Description: A race condition in the store int with restart() function in arch/x86/kernel/cpu/mcheck/mce.c allows local users to cause a denial of service (panic) by leveraging root access to write to the check interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tboot versions prior to 1.9.7 **Description** The issue concerns the validation of certain function pointers in tboot, which can lead to arbitrary code execution. This allows local users to overwrite dynamic PCRs of the Trusted Platform Module (TPM) by hooking these function pointers. **Recommendations** For versions prior to 1.9.7, update to version 1.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the function pointers in question to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.12.9 Linux kernel versions prior to 4.9 **Description** The issue is related to the acpi ns evaluate() function in the Linux kernel, which does not properly flush the operand cache. This can cause a kernel stack dump, allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism. **Recommendations** For Linux kernel versions prior to 4.12.9, update to version 4.12.9 or later to resolve the issue. For Linux kernel versions prior to 4.9, update to version 4.9 or later to strengthen the KASLR protection mechanism.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.12.10 Linux kernel versions prior to 4.9 (for KASLR protection mechanism bypass) **Description** The issue allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. This is caused by the acpi ds create operands() function in drivers/acpi/acpica/dsutils.c not flushing the operand cache, leading to a kernel stack dump. **Recommendations** For Linux kernel versions prior to 4.12.10, update to version 4.12.10 or later to resolve the issue. For Linux kernel versions prior to 4.9, update to version 4.9 or later to prevent KASLR protection mechanism bypass. As a temporary workaround, consider restricting access to crafted ACPI tables until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.12 Linux kernel versions prior to 4.9 (for KASLR protection mechanism bypass) **Description** The issue allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. This is due to the acpi ns terminate() function in drivers/acpi/acpica/nsutils.c not flushing the operand cache, which causes a kernel stack dump. **Recommendations** For Linux kernel versions prior to 4.12, update to version 4.12 or later to resolve the issue. For Linux kernel versions prior to 4.9, update to version 4.9 or later to prevent KASLR protection mechanism bypass. As a temporary workaround, consider restricting access to crafted ACPI tables until a patch is available.