Debian Debian Linux 11.0

tracing: Verify event formats that have "%*p.."

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

regulator: max20086: fix invalid memory access

staging: media: max96712: fix kernel oops when removing module

pinctrl: at91: Fix possible out-of-boundary access

arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()

net: usb: aqc111: fix error handling of usbnet read calls

netfilter: xt_nfacct: don't assume acct name is null-terminated

iio: light: as73211: Ensure buffer holes are zeroed

comedi: aio_iiro_16: Fix bit shift out of bounds

comedi: pcl812: Fix bit shift out of bounds

media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

md/raid1: Fix stack memory use after return in raid1_reshape

usb: core: config: Prevent OOB read in SS endpoint companion parsing

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

comedi: das6402: Fix bit shift out of bounds

software node: Correct a OOB check in software_node_get_reference_args()

comedi: das16m1: Fix bit shift out of bounds

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

bpf: Reject %p% format string in bprintf-like helpers

comedi: pcl726: Prevent invalid irq number

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

wifi: mwifiex: Initialize the chan_stats array to zero

mm/slub: avoid accessing metadata when pointer is invalid in object_err()

efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

i40e: Fix potential invalid access when MAC list is empty

usb: gadget: configfs: Fix OOB read on empty string write

wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap

mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory

iio: imu: bno055: fix OOB access of hw_xlate array

VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

Local privilege escalation with FileStore

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.

Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries will be corrected when such a node is written later. There is a small time window when a new domain is created, where the access rights of a past domain with the same domid as the new one will be regarded to be still valid, leading to the new domain being able to get access to a node which was meant to be accessible by the removed domain. For this to happen another domain needs to write the node before the newly created domain is being introduced to Xenstore by dom0.

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.