Wei Chen

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a double-free vulnerability in the ext4 file system, specifically in the `ext4 move extents()` function. This vulnerability can cause a denial of service when the `trim` command is executed, due to a zero-division bug triggered in `mb update avg fragment size()`. The problem arises when the `moved len` variable is not updated after successfully moving some extents, leading to the freeing of overlapped extents twice in `ext4 mb release inode pa()` and `ext4 process freed data()`. This results in `bb free` being incremented twice, causing the zero-division bug when `trim` is executed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An out-of-bounds write issue was found in the Linux kernel's SLIMpro I2C device driver. The `data->block[0]` variable from userspace was not limited to a value between 0-255 and was used as the size of a `memcpy()`, possibly writing beyond the end of `dma buffer`. This could allow a local privileged user to crash the system or potentially achieve code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.1.0-rc8 **Description** The vulnerability is related to the `TCA MPLS LABEL` attribute in the Linux kernel, which has an invalid combination of type `NLA U32` and validation type `NLA VALIDATE FUNCTION`. This can trigger a warning in `nla get range unsigned()` when validation of the attribute fails. The associated `min`/`max` fields in the policy are negative as they are aliased by the `validate` field. The fix involves changing the attribute type to `NLA BINARY`, which is consistent with the comment above `struct nla policy` and all other users of `NLA POLICY VALIDATE FN()`. As a result, the length validation is moved to the validation function. **Recommendations** To resolve the issue, update the Linux kernel to a version later than 6.1.0-rc8. If updating is not possible, consider temporarily disabling the `act mpls` module to minimize the risk of exploitation. However, this is not a permanent solution and may have unintended consequences on the system's functionality. Note: The provided information does not specify the exact version that contains the fix, but it is mentioned that the issue is resolved in versions later than 6.1.0-rc8.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** The issue is related to the Infiniband driver in the Linux Kernel, specifically with the compare netdev and ip function in the drivers/infiniband/core/cma.c module. It involves improper cleanup, resulting in an out-of-boundary read. A local user can exploit this to crash the system or escalate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a NULL pointer dereference in the `can rcv filter` function. This occurs due to a missing initialization of `ml priv` in the receive path of CAN frames. The problem arose after a commit introduced a CAN-specific pointer in the `struct net device`, making the check for `dev->type` to be `ARPHRD CAN` insufficient. This is because bonding or tun netdevices claim to be CAN devices but do not initialize `ml priv` accordingly. The vulnerability can be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux (affected versions not specified) **Description** The issue is related to a null pointer dereference in the can protocol in the net/can/af can.c module of the Linux kernel. This occurs because `ml priv` may not be initialized in the receive path of CAN frames. A local user could exploit this to crash the system or potentially cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a NULL pointer dereference in the `sk user ns()` function, which is caused by the newly allocated `skb` not having `sk` in the `unix diag get exact()` function. This can lead to a denial of service. The `unix diag get exact()` function is used to get the exact socket information. The `sk diag fill()` function is also involved, which fills the socket information. The `NETLINK CB(in skb).sk` is used to get the user namespace. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dvb-usb/az6027.c. The issue arises because messages from user space are not properly checked before being transferred into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. The vulnerability is related to the function `az6027 i2c xfer()` and is caused by a null pointer dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a data race flaw in the Linux kernel's implementation of the TIPC protocol, which can lead to a NULL pointer dereference. This flaw is located between where `con` is allocated and `con->sock` is set, specifically when accessing `con->sock->sk` in `net/tipc/topsrv.c`. The exploitation of this issue may allow a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream sched.c. If `stream in` allocation fails, `stream out` is freed and would further be accessed. This could allow a local user to crash the system or potentially cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.