Most recent entries from all

BELL-CVE-2023-54082

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

fkie_cve-2023-54082

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

GHSA-ggff-5vp9-rcr3

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix null-ptr-deref in unix_stream_sendpage().

Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro.

unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue.

If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection.

The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock.

So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue.

Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring.

This patch is originally written by Linus Torvalds.

BUG: unable to handle page fault for address: ffff988004dd6870 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP PTI CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74…

msrc_CVE-2023-54082 — af_unix: Fix null-ptr-deref in unix_stream_sendpage().

msrc_CVE-2023-54082

UBUNTU-CVE-2023-54082

Affected: Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp and 83 more

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

WID-SEC-W-2025-2929 — Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.