kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker ...

gustave

c Airbus 2021, sduverger GUSTAVE - Fuzzer de noyau OS embarqué Qu'est-ce que c'est ? GUSTAVE est une plateforme de fuzzing pour les noyaux de systèmes d'exploitation embarqués. Il est basé sur QEMU et AFL et tous ses frères forkserver. Il permet de fuzzer les noyaux OS comme de simples...

meltdown-exploit

PREUVE DE CONCEPT DE L'EXPLOIT MELTDOWN Les optimisations spéculatives exécutent du code de manière non sécurisée, laissant des traces de données dans la microarchitecture comme le cache. Lipp et al. 2018 ont publié leur code le 09/01/2018 sur https://github.com/IAIK/meltdown. Consultez leur...

difuze

difuze : Fuzzer pour les pilotes du noyau Linux Ce dépôt contient toutes les sources scripts d'installation inclus dont vous avez besoin pour faire fonctionner difuze. Testé sur Ubuntu = 14.04.5 LTS 0. Exécuter difuze depuis Docker Consultez le readme Comme expliqué dans notre article, il y a deu...

magisk-renef

MagiskRenef Un module Magisk / KernelSU / APatch qui empaquette et exécute automatiquement renef — un kit d'instrumentation dynamique pour Android. Inspiré par magisk-frida. Prérequis Appareil Android rooté Magisk / KernelSU / KernelSU Next / APatch ARM64 uniquement — renef ne prend en charge que...

vsock_poc

vsockpoc Исследование ошибки, стоящей за CVE-2021-26708 В этом репозитории содержатся краткие заметки о CVE-2021-26708 и о том, как эту ошибку можно превратить в примитив записи типа Use After Free. Приведённый здесь PoC — это не полноценный эксплойт, а лишь мой тестовый стенд, который я...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...

kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...

kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: dm cache policy smq: fix missing locks in invalidating cache blocks

A flaw was found in the Linux kernel's device-mapper dm cache policy, specifically within the smq module. In passthrough mode, the invalidatemapping operation lacks proper locking, allowing for concurrent access. This can lead to data races, resulting in data corruption or use-after-free issues,...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap

A flaw was found in the Linux kernel's RDMA/rxe component. A race condition in the rxemmap function, which manages memory for Remote Direct Memory Access RDMA operations, can lead to a use-after-free vulnerability. A local attacker could exploit this timing issue to cause a system crash, resultin...

kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

A flaw was found in the Linux kernel. A race condition exists in the xfrm policy handling, specifically within the xfrmpolicybyselctx function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

kernel: xfrm: input: hold netns during deferred transport reinjection

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...