In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as below could trigger kernel dump: Use U-Boot to start remote processor(rproc) with resource table published to a fixed address by rproc. After Kernel boots up, stop the rproc, load a new firmware which doesn't have resource table ,and start rproc. When starting rproc with a firmware not have resource table, `memcpy(loaded_table, rproc->cached_table, rproc->table_sz)` will trigger dump, because rproc->cache_table is set to NULL during the last stop operation, but rproc->table_sz is still valid. This issue is found on i.MX8MP and i.MX9. Dump as below: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_memcpy_generic+0x110/0x22c lr : rproc_start+0x88/0x1e0 Call trace: __pi_memcpy_generic+0x110/0x22c (P) rproc_boot+0x198/0x57c state_store+0x40/0x104 dev_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x120/0x1cc vfs_write+0x240/0x378 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xcc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c Clear rproc->table_sz to address the issue.
CVE-2024-56588 is a medium severity vulnerability in the Linux kernel's hisi_sas SCSI driver. The issue arises because debugfs files are created only after a user triggers a dump, which can cause a kernel NULL pointer dereference and system hang if a dump is triggered while the driver is unbound. The fix involves creating all debugfs directories and files during the driver's initialization to prevent this race condition and memory access error.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in the pg_dump utility of PostgreSQL. This flaw allows an object creator to execute arbitrary SQL functions with the privileges of the user running pg_dump, which is often a superuser. The attack involves replacing a relation type with a view or foreign table during the dump process. Versions prior to PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. A patch is available to address this issue.
Red Hat has released a security update for Red Hat build of Quarkus 2.13.9.SP2 addressing three vulnerabilities: CVE-2024-1597, which allows SQL injection via the PostgreSQL JDBC Driver when using PreferQueryMode=SIMPLE; CVE-2024-25710, a denial of service caused by an infinite loop when processing corrupted DUMP files in Apache Commons Compress; and CVE-2024-26308, which can cause an OutOfMemoryError when unpacking broken Pack200 files in Apache Commons Compress. These issues are rated as important by Red Hat and are fixed in this update. Users should apply this update after ensuring all prior relevant errata are installed.
A denial of service vulnerability (CVE-2024-25710) exists in the commons-compress library used by Red Hat Migration Toolkit for Runtimes 1.2.5. The issue is caused by an infinite loop triggered by a corrupted DUMP file. Red Hat has released an update addressing this vulnerability in version 1.2.5 of the Migration Toolkit for Runtimes. The severity of this issue is rated as moderate by Red Hat. No known exploits are reported in the wild at this time.
CVE-2024-26873 is a medium severity vulnerability in the Linux kernel's hisi_sas driver that causes a deadlock related to automatic dump during error handling. The issue occurs when a disabling PHY command is issued and a 2-bit ECC error happens simultaneously, leading to hung tasks due to circular semaphore dependencies. This deadlock prevents the controller from resetting properly, impacting system availability.
A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine.