CVE-2024-38562

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: evitar cálculos de direcciones mediante indexación de matrices fuera de los límites Antes de poder utilizar request->channels[], se debe configurar request->n_channels. Además, los cálculos de direcciones para la memoria después de la matriz de "canales" deben calcularse a partir de la base de asignación ("solicitud") en lugar de mediante el primer índice "fuera de los límites" de "canales"; de lo contrario, la verificación de los límites en tiempo de ejecución arrojará un advertencia.

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexing Before request->channels[] can be used, request->n_channels must be set. Additionally, address calculations for memory after the "channels" array need to be calculated from the allocation base ("request") rather than via the first "out of bounds" index of "channels", otherwise run-time bounds checking will throw a warning.

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.