Vasily Averin

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 2.6.32 **Description** The issue is related to the net dma code in the tcp recvmsg() function, which is thread-unsafe. This can be exploited by an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel on ioatdma-enabled hardware with net dma enabled, potentially leading to memory leaks, host crashes, denial-of-service, or random memory corruption. **Recommendations** For Linux kernel version 2.6.32, consider disabling the net dma code or restricting the use of the tcp recvmsg() function to minimize the risk of exploitation until a patch is available. Additionally, avoid using ioatdma-enabled hardware with net dma enabled for sensitive operations.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions up to 3.10 **Description** A denial of service situation can be created by an attacker with local access via a NULL pointer dereference in the `ovl posix acl create` function in `fs/overlayfs/dir.c`. This allows attackers who can create directories on overlayfs to crash the kernel, resulting in a denial of service. The issue is related to errors in pointer dereferencing in the `ovl posix acl create` function. **Recommendations** For Linux kernel versions up to 3.10, as a temporary workaround, consider restricting access to the `ovl posix acl create` function in `fs/overlayfs/dir.c` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the cleancache subsystem of the Linux kernel, which incorrectly initializes new files. This can allow an attacker to expose protected information. The problem occurs when the cleancache subsystem clears an inode after the final file truncation, and a new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to an out-of-bounds memory write flaw in the Linux kernel's Voice Over IP H.323 connection tracking functionality when handling connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service, and poses a threat to confidentiality, integrity, and system availability. The flaw is also associated with a possible out of bounds write due to a missing bounds check in nf conntrack helper q931 of nf conntrack h323 main.c, which could lead to local escalation of privilege without requiring additional execution privileges or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.0 kernel-kdumppae (affected versions not specified) **Description** The issue allows local users to cause a denial of service, resulting in a system hang, via a specific system call. Additionally, multiple vulnerabilities in the kernel-kdumppae package of the SUSE Linux Enterprise operating system can lead to disruption of protected information availability, and these vulnerabilities can be exploited remotely. **Recommendations** For Linux kernel versions prior to 3.0, update to version 3.0 or later to resolve the issue. For kernel-kdumppae, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.13 **Description** The issue arises from the block prepare write function in fs/buffer.c, which fails to properly clear buffers during certain error conditions. This allows local users to read portions of files that have been unlinked. **Recommendations** For Linux kernel versions prior to 2.6.13, update to version 2.6.13 or later to resolve the issue.