Several recently discovered vulnerabilities:
- CVE-2023-39191 — a vulnerability in the eBPF subsystem that allows a local user to elevate their privileges and execute code at the Linux kernel level. The vulnerability is due to improper validation of eBPF programs submitted by the user for execution. To carry out the attack, the user must be able to load their own BPF program (if the kernel.unprivileged_bpf_disabled parameter is set to 0, for example, as in Ubuntu 20.04). Details about the vulnerability were reported to the kernel developers back in December last year, and the fix was implemented discreetly in January.
- CVE-2023-42753 — an error when handling array indices in the ipset implementation within the netfilter kernel subsystem, which can be exploited to increment/decrement pointers and create conditions for reading or writing to memory outside the allocated buffer. A proof-of-concept exploit has been prepared that triggers a crash (more dangerous exploitation scenarios cannot be ruled out). The fix has been included in the kernel releases 5.4.257, 6.5.3, 6.4.16, 6.1.53, 5.10.195, 5.15.132.
- CVE-2023-39192, CVE-2023-39193 — several vulnerabilities in the Linux kernel that lead to the leakage of kernel memory contents due to the ability to read from areas outside the allocated buffer in the match_flags and u32_match_it functions of the Netfilter subsystem, as well as in the state filter processing code. The vulnerabilities were addressed in August (1, 2) and June.
- CVE-2023-42755 — a vulnerability that allows an unprivileged local user to crash the kernel due to a pointer handling error in the RSVP traffic classifier. The issue occurs in LTS kernels 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14. A proof-of-concept exploit has been prepared. The fix has not yet been accepted into the kernel and is available as a patch.
- CVE-2023-42756 — a race condition in the NetFilter kernel subsystem that can be exploited by a local user to trigger a Panic state. A proof-of-concept exploit is available, functioning at least in kernels 6.5.rc7, 6.1, and 5.10. The fix has not yet been accepted into the kernel and is available as a patch.
- CVE-2023-4527 — stack overflow in the Glibc library occurring in the getaddrinfo function when processing a DNS response larger than 2048 bytes. This vulnerability can lead to data leakage from the stack or a crash. It affects only Glibc versions newer than 2.36 when using the 'no-aaaa' option in /etc/resolv.conf.
- CVE-2023-40474, CVE-2023-40475 — vulnerabilities in the GStreamer multimedia framework caused by integer overflow in handlers of MXF video files. These vulnerabilities can allow an attacker to execute code when processing specially crafted MXF files in applications that use GStreamer. The issue has been fixed in the gst-plugins-bad package 1.22.6.
- CVE-2023-40476 — buffer overflow in the video handler for H.265 offered in GStreamer, allowing code execution when processing specially crafted video. The vulnerability has been fixed in the gst-plugins-bad package 1.22.6.
- Analysis — analysis of an exploit utilizing the CVE-2023-36664 vulnerability in the Ghostscript package to execute its code when opening specially crafted PostScript documents. The issue is caused by improper handling of filenames starting with '|' or prefix %pipe%. The vulnerability has been resolved in Ghostscript release 10.01.2.
- CVE-2023-3341, CVE-2023-4236 — vulnerabilities in the BIND 9 DNS server that lead to a crash of the named process when processing specially crafted control messages (access to the TCP port through which named is managed is sufficient (by default, open only for the loopback interface), knowledge of the RNDC key is not required) or creating a certain high load in DNS-over-TLS mode. These vulnerabilities have been fixed in BIND releases 9.16.44, 9.18.19, and 9.19.17.
- CVE-2023-4504 — a vulnerability in server CUPS printing and the libppd library, leading to a buffer overflow when parsing specially formatted Postscript documents. It is possible that the vulnerability could be exploited to execute arbitrary code on the system. The issue has been resolved in CUPS releases 2.4.7 (patch) and libppd 2.0.0 (patch).
Source: opennet.ru
