AZL-53519 CVE-2024-50265 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2xaremove Syzkaller is able to provoke null-ptr-dereference in ocfs2xaremove: 57.319872 a.out,1161,7:ocfs2xaremove:2028 ERROR: status = -12 57.320420...

DEBIAN-CVE-2024-50265

In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2xaremove Syzkaller is able to provoke null-ptr-dereference in ocfs2xaremove: 57.319872 a.out,1161,7:ocfs2xaremove:2028 ERROR: status = -12 57.320420...

UBUNTU-CVE-2024-50265

In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2xaremove Syzkaller is able to provoke null-ptr-dereference in ocfs2xaremove: 57.319872 a.out,1161,7:ocfs2xaremove:2028 ERROR: status = -12 57.320420...

Lazarus Group Targets macOS with RustyAttr Trojan in Fake Job PDFs

Group-IB has uncovered Lazarus group’s stealthy new trojan and technique of hiding malicious code in extended attributes on…...

CVE-2023-4458

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on...

CVE-2023-4458

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on...

UBUNTU-CVE-2023-4458

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on...

CVE-2023-4458

CVE-2023-4458 affects the Linux kernel ksmbd module, specifically in the parsing of extended attributes. The flaw stems from insufficient validation of user-supplied data, allowing an out-of-bounds read (read past the end of an allocated buffer) and enabling information disclosure on affected sys...

New RustyAttr Malware Targets macOS Through Extended Attribute Abuse

Threat actors have been found leveraging a new technique that abuses extended attributes for macOS files to smuggle a new malware called RustyAttr. The Singaporean cybersecurity company has attributed the novel activity with moderate confidence to the infamous North Korea-linked Lazarus Group,...

CVE-2023-4458: Out-of-bounds Read

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on...

kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

A flaw was found in the Linux kernel. A system error can be reliably replicated with specific filesystem settings, allowing an attacker to cause a denial of service...

ocfs2: reserve space for inline xattr before attaching reflink tree

...

ext4: avoid OOB when system.data xattr changes underneath the filesystem

...

ocfs2: add bounds checking to ocfs2_xattr_find_entry()

...

SUSE CVE-2024-49958

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reserve space for inline xattr before attaching reflink tree One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn outp...

sleuthkit:sleuthkit_fls_hfs_fuzzer: Heap-buffer-overflow in hfs_load_extended_attrs

Project: https://github.com/sleuthkit/sleuthkit.git Detailed Report: https://oss-fuzz.com/testcase?key=5572782731100160 Project: sleuthkit Fuzzing Engine: honggfuzz Fuzz Target: sleuthkitflshfsfuzzer Job Type: honggfuzzasansleuthkit Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

AZL-50823 CVE-2024-47701 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When looking up for an entry in an inlined directory, if evalueoffs is changed underneath the filesystem by some change in the block device, it will lead to...

The Samba vfs_fruit module uses extended file attributes (EA xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd typically root.

...

The vulnerability of the ea_get() function in the file system jfs of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the eaget function in the fs/jfs/xattr.c file of the JFS file system in the Linux operating system is related to memory writing beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility o...

kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

A flaw was found in the Linux kernel. A system error can be reliably replicated with specific filesystem settings, allowing an attacker to cause a denial of service...