CVE-2024-53107

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: evitar el desbordamiento de enteros en pagemap_scan_get_args() La variable "arg->vec_len" es una u64 que proviene del usuario al inicio de la función. La multiplicación "arg->vec_len * sizeof(struct page_region))" puede provocar un ajuste de enteros. Utilice size_mul() para evitarlo. Además, las funciones size_add/mul() funcionan en unsigned long, por lo que para los sistemas de 32 bits debemos asegurarnos de que "arg->vec_len" quepa en un unsigned long.

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args() The "arg->vec_len" variable is a u64 that comes from the user at the start of the function. The "arg->vec_len * sizeof(struct page_region))" multiplication can lead to integer wrapping. Use size_mul() to avoid that. Also the size_add/mul() functions work on unsigned long so for 32bit systems we need to ensure that "arg->vec_len" fits in an unsigned long.

Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rogue device and possibly execute arbitrary code. Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service or possibly execute arbitrary code.