An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.

kernel: when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c kernel: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() kernel: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() kernel: save/restore speculative MSRs during S3 suspend/resume kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter Kernel: bluetooth: Unauthorized management command execution kernel: OOB access in the Linux kernel's XFS subsystem kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests hw: amd: Cross-Process Information Leak kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() kernel: buffer overflow in ceph file net/ceph/messenger_v2.c

kernel: seccomp: Move copy_seccomp() to no failure path kernel: save/restore speculative MSRs during S3 suspend/resume kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free hw: amd: Cross-Process Information Leak kernel: bypass of shadow stack protection due to a logic error kernel: nf_tables: use-after-free in nft_chain_lookup_byid() kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() kernel: buffer overflow in ceph file net/ceph/messenger_v2.c kernel: Linux kernel: Denial of Service due to GIC state corruption on NVIDIA T241 platforms kernel: Linux kernel iavf driver: Denial of Service via use-after-free vulnerability kernel: virt/coco/sev-guest: Double-buffer messages

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 87 more

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.

Ein lokaler Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um beliebigen Programmcode auszuführen.