Public newsroom
Upstream briefs, filed by beat.
Short notes on what landed, what broke, and what to read next.
A leftover giant-packet mark on an IP fragment can panic the host
A tap or a guest can attach giant-packet metadata to a single IP fragment. After the host glues the pieces back together, that leftover mark sends the kernel into a BUG that panics the machine.
VAPIC writable window could cover SMRAM or PCI BARs
QEMU mapped the virtual APIC acceleration ROM as high-priority writable RAM. The fix confines the region to option-ROM low memory.
SCSI WRITE SAME can copy host heap into the guest disk
A guest with an emulated SCSI disk can race a block-size change against WRITE SAME so QEMU reads tens of kilobytes past a host heap buffer and writes that memory into the guest's own image. The fix clamps the copy to the buffer that was actually allocated.
IBM Z protected service-call copy can read past a host heap buffer
On IBM Z, a guest talks to QEMU through a small service-call control block. The protected-virtualization copy of that block could read past the host buffer, because a later rewrite of the request length was used as the copy size.
Disk command-list unmap can point at freed host memory
The AHCI host adapter maps the guest's command list in host memory. If that list sits on an MMIO region, unmapping it frees a bounce buffer, and a later programmed-I/O completion still used the old pointer.
Surprise disk unplug can free host memory under an in-flight request
On a PCIe machine, a guest can power the disk slot off while a read is still in flight. The host then finishes that request against memory it already freed.
Incoming IDE migration can write host heap
QEMU keeps a small buffer for an in-progress disk transfer. A crafted incoming migration stream could point that window off the buffer, and the resumed guest then turns data-port writes into a host heap write.
AppArmor writes past a profile-name list when a process sets its own confinement
AppArmor builds a list of profile names when a process asks to change its own confinement. The list was one slot short for the terminator, so a long compound name wrote a pointer past the end.
AppArmor can free a process's credentials while they are still in use
AppArmor is the Linux security module that pins a confinement profile to each process. When a profile was replaced or disabled, it swapped that process's credentials from inside filesystem work, so a later lookup could touch freed memory.
QEMU ships v11.1.1, v11.0.4, and v10.0.13
Three stable point releases landed on the public tree. They bump the version and include the pseries watchdog bound check, but not the VGA or QXL CVEs that landed on master with the graphics pull.
A pseries guest can poke one slot before the watchdog table
pseries is the default IBM POWER virtual machine. A guest hypercall that starts the watchdog accepted index zero and then used the slot before the start of the table, which tripped a host sanitizer crash.
QEMU QXL display can read past video RAM on a guest-chosen stride
QXL is the Spice display device many Linux guests use. A guest can create a primary surface whose row width is smaller than the pixel width it declared, and the next host screen refresh then reads past the video buffer.
QEMU VGA can write past the display surface after a mode switch
VGA is the default display chip on a typical PC virtual machine. After a guest flips from graphics to text, QEMU can paint into a too-small surface using colors the guest chose, which writes off the end of host memory on every screen refresh.
A shared-memory page-size race can escalate privileges
POSIX shared memory can back an object with large pages. Two callers could set the page size at once, leave the object inconsistent, and escalate privileges.
A terminal ioctl race can escalate privileges
The kernel's terminal layer can drop a lock while attaching a controlling terminal. A local user can race that window and escalate privileges.
Base OpenSSL picks up a batch of memory and protocol bugs
FreeBSD ships OpenSSL in the base system. The signed advisory lists a heap overflow, a double free, and remote paths that can exhaust memory, with impact from denial of service up to possible remote code execution.
The sound driver can escalate privileges when two devices start together
The sound driver can start several audio devices at once. With more than one device, a local user could hit a use-after-free and escalate privileges.
A local socket bug can escalate privileges on FreeBSD 15
Unix sockets are how programs on the same machine pass messages and file descriptors. A receive-path bug could free a message and then still use it, and the advisory says a local user can escalate privileges.
FreeBSD's userland PPP daemon overflowed on a crafted peer option
The userland PPP program is the old dial-up and point-to-point helper still in the base system. A peer could send a malformed endpoint option and the daemon would write past its buffers.
OpenBSD 7.8 and 7.9 pick up the XML parser fixes from 2.8.3
The system XML library on the two current releases is taking the 2.8.3 changes. The drop lists fifteen CVEs and keeps the library ABI the same.
Asking a network interface for its stats leaked leftover kernel stack
A program can ask the kernel for a network interface's counters. On most machines that copy included four leftover bytes of kernel stack.
Asking for a process command line could return leftover kernel memory
A caller can ask the kernel for another process's command line. If that copy came back empty, leftover uninitialized kernel memory could still be handed back.
OpenRISC signal return let a local process drop memory protection
OpenRISC is a small CPU architecture used in QEMU and on FPGA boards. A local process could return from a signal with a crafted frame that turned off memory protection, then read and write any physical address.