Shopify: mruby-engine: UAF in MRubyEngine#initialize enables local RCE

Summary Double-init of MRubyEngine frees engine + unmaps mspace, but leaves Ruby DATAPTR dangling. Kernel reuses freed VA via mmapMAPFIXED. Attacker forges memrubyengine struct + mrbstate in reclaimed region, points mrbstate-allocf at libc.system, arranges bytes of mrbstate to also spell a shell...

Linux kernel kprobes Heap Buffer Overflow DoS

The vulnerability of the unregisterkprobetop function in the kernel/kprobes.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

Linux UBI Create Volume Buffer Overflow

Vulnerability of the ubicreatevolume function in the drivers/mtd/ubi/vmt.c module – The Linux kernel’s memory support driver involves reusing previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Linux kernel skb_try_coalesce Heap Buffer Overflow DoS

The vulnerability of the skbtrycoalesce function in the net/core/skbuff.c module, which is part of Linux’s kernel network functions, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Linux block bfq-iosched Heap Buffer Overflow DoS

The vulnerability of the bfqbiomerge function in the block/bfq-iosched.c module relates to the reutilization of previously released memory in Linux’s kernel-level block storage mechanism. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the packetcreate function in the net/packet/afpacket.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Linux Kernel do_vcc_ioctl()

The vulnerability of the dovccioctl function in the net/atm/ioctl.c module, which implements the ATM network protocol in the Linux operating system, is related to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attack...

Linux fs/io_uring.c DoS

The vulnerability of the fs/iouring.c component in the Linux kernel operating system is related to the reutilization of freed memory. Exploiting this vulnerability can allow an attacker to cause a service failure...