Debian Debian Linux 11.0

PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2).

snapd could be made to escalate privileges and run programs as administrator

KVM: x86: Reset IRTE to host control if *new* route isn't postable

insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / value between old and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition, omitting flushes where such are necessary.

HID: core: ensure the allocated report buffer can contain the reserved report ID

Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.

wifi: ath11k: fix node corruption in ar->arvifs list

KVM: arm64: Tear down vGIC on failed vCPU creation

batman-adv: fix OOB read/write in network-coding decode

thunderbolt: Do not double dequeue a configuration request

rose: fix dangling neighbour pointers in rose_rt_device_down()

wifi: ath11k: clear initialized flag for deinit-ed srng lists

ax25: properly unshare skbs in ax25_kiss_rcv()

HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

net: mctp: Set SOCK_RCU_FREE

wifi: cfg80211: fix use-after-free in cmp_bss()

wifi: prevent A-MSDU attacks in mesh networks

wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

net: rose: include node references in rose_neigh refcount

net: rose: convert 'use' field to refcount_t

vhost-scsi: protect vq->log_used with vq->mutex

Laravel allows environment manipulation via query string

perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.

A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Permissions granted to applications can be hidden from the user at install time

x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334).

eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabled

bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabled

pptp: ensure minimal skb length in pptp_xmit()

pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

XStream is vulnerable to a Remote Command Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack