CVSS: 5.1EPSS: 0%CPEs: 8EXPL: 0CVE-2024-26583 – tls: fix race between async notify and socket close
https://notcve.org/view.php?id=CVE-2024-26583
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tls: corrige la ejecución entre la notificación asíncrona y el cierre del socket. El hilo de envío (uno que llamó recvmsg/sendmsg) puede salir tan pronto como el controlador criptográfico asíncrono llame a complete(), por lo que cualquier código pasado ese punto corre el riesgo de tocar datos ya liberados. Intente evitar por completo el bloqueo y las banderas adicionales. Haga que el hilo principal contenga una referencia adicional, de esta manera podemos depender únicamente del contador de referencia atómica para la sincronización. • https://git.kernel.org/stable/c/0cada33241d9de205522e3858b18e506ca5cce2c https://git.kernel.org/stable/c/cf4cc95a15f599560c7abd89095a7973a4b9cec3 https://git.kernel.org/stable/c/8dc5025c6a444548ab5e2ef9e6f4479f71c7c1a0 https://git.kernel.org/stable/c/9b81d43da15e56ed89f083f326561acdcaf549ce https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7 https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01 https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52442 – ksmbd: validate session id and tree id in compound request
https://notcve.org/view.php?id=CVE-2023-52442
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ksmbd: validar la identificación de la sesión y la identificación del árbol en la solicitud compuesta `smb2_get_msg()` en smb2_get_ksmbd_tcon() y smb2_check_user_session() siempre devolverá el encabezado smb2 de la primera solicitud en una solicitud compuesta. si `SMB2_TREE_CONNECT_HE` es el primer comando en la solicitud compuesta, devolverá 0, es decir, se omite la verificación de identificación del árbol. Este parche usa ksmbd_req_buf_next() para obtener el comando actual en compuesto. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. • https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693 https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2023-52441 – ksmbd: fix out of bounds in init_smb2_rsp_hdr()
https://notcve.org/view.php?id=CVE-2023-52441
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ksmbd: corrección fuera de los límites en init_smb2_rsp_hdr() Si el cliente envía una solicitud de negociación smb2 y luego envía una solicitud de negociación smb1, se llama a init_smb2_rsp_hdr para la solicitud de negociación smb1 ya que need_neg está configurado en falso. Este parche ignora los paquetes smb1 después de que ->need_neg se establece en falso. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. • https://git.kernel.org/stable/c/5c0df9d30c289d6b9d7d44e2a450de2f8e3cf40b https://git.kernel.org/stable/c/330d900620dfc9893011d725b3620cd2ee0bc2bc https://git.kernel.org/stable/c/aa669ef229ae8dd779da9caa24e254964545895f https://git.kernel.org/stable/c/536bb492d39bb6c080c92f31e8a55fe9934f452b • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2023-52440 – ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
https://notcve.org/view.php?id=CVE-2023-52440
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ksmbd: corrige el desbordamiento de slub en ksmbd_decode_ntlmssp_auth_blob() Si authblob->SessionKey.Length es mayor que el tamaño de la clave de sesión (CIFS_KEY_SIZE), puede ocurrir un desbordamiento de slub en los códigos de intercambio de claves. cifs_arc4_crypt copia a la matriz de claves de sesión desde SessionKey del cliente. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. The specific flaw exists within the processing of session keys. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. • https://git.kernel.org/stable/c/bd554ed4fdc3d38404a1c43d428432577573e809 https://git.kernel.org/stable/c/30fd6521b2fbd9b767e438e31945e5ea3e3a2fba https://git.kernel.org/stable/c/7f1d6cb0eb6af3a8088dc24b7ddee9a9711538c4 https://git.kernel.org/stable/c/ecd7e1c562cb08e41957fcd4b0e404de5ab38e20 https://git.kernel.org/stable/c/4b081ce0d830b684fdf967abc3696d1261387254 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-52439 – uio: Fix use-after-free in uio_open
https://notcve.org/view.php?id=CVE-2023-52439
In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. • https://git.kernel.org/stable/c/57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 https://git.kernel.org/stable/c/13af019c87f2d90e663742cb1a819834048842ae https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50 https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570 https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7 https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9 • CWE-415: Double Free CWE-416: Use After Free •