[kernel-cve-report] New CVE entries this week

[Masami Ichikawa <masami.ichikawa@miraclelinux.com>]

Hi!

It's this week's CVE report.

This week reported 4 new CVEs and 0 updated CVEs.

* New CVEs

CVE-2023-39197: netfilter: conntrack: dccp: copy entire header to
stack buffer, not just basic one

CVSS v3(NIST): N/A

An out-of-bound access bug was found in the netfilter conntrack
feature. This vulnerability will expose sensitive information via DCCP
protocol to remote user.
This bug was introduced by commit 2bc7804 ("[NETFILTER]: nf_conntrack:
add DCCP protocol support") in 2.6.26-rc1.

Fixed status
mainline: [ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30]
stable/5.10: [9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8]
stable/5.15: [c052797ac36813419ad3bfa54cb8615db4b41f15]
stable/5.4: [337fdce450637ea663bc816edc2ba81e5cdad02e]
stable/6.1: [26bd1f210d3783a691052c51d76bb8a8bbd24c67]

CVE-2023-39198: drm/qxl: fix UAF on handle creation

CVSS v3(NIST): N/A
CVSS v3(CNA): 7.5 (HIGH)

A race condition was found in the QXL driver in the Linux kernel. The
qxl_mode_dumb_create() function dereferences the qobj returned by the
qxl_gem_object_create_with_handle(), but the handle is the only one
holding a reference to it. This flaw allows an attacker to guess the
returned handle value and trigger a use-after-free issue, potentially
leading to a denial of service or privilege escalation.

Fixed status
mainline: [c611589b4259ed63b9b77be6872b1ce07ec0ac16]
stable/5.15: [d578c919deb786b4d6ba8c7639255cb658731671]
stable/6.1: [a1fa8f0fc58e0ec972f718030710efc442d7304b]

CVE-2023-6039: net: usb: lan78xx: reorder cleanup operations to avoid UAF bugs

CVSS v3(NIST): N/A
CVSS v3(CNA): 5.5 (MEDIUM)

A use-after-free flaw was found in lan78xx_disconnect in
drivers/net/usb/lan78xx.c in the network sub-component,
net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker
to crash the system when the LAN78XX USB device detaches.

Introduced by commit 77dfff5 ("lan78xx: Fix race condition in
disconnect handling") in 5.15-rc1. Prior to 5.15 kernels are not
affected.

Fixed status
mainline: [1e7417c188d0a83fb385ba2dbe35fd2563f2b6f3]

CVE-2023-6111: netfilter: nf_tables: remove catchall element in GC sync path

CVSS v3(NIST): N/A
CVSS v3(CNA): 7.8 (HIGH)

This bug was introduced by commit 4a9e12e ("netfilter: nft_set_pipapo:
call nft_trans_gc_queue_sync() in catchall GC") in 6.6-rc3.
This commit was backported to 5.15, 6.1, and 6.5 so that prior to 5.15
are not affected.

Fixed status
mainline: [93995bf4af2c5a99e2a87f0cd5ce547d31eb7630]

* Updated CVEs

No update.

Currently tracking CVEs

CVE-2021-31615: Unencrypted Bluetooth Low Energy baseband links in
Bluetooth Core Specifications 4.0 through 5.2

There is no fix information.

CVE-2020-26556: kernel: malleable commitment Bluetooth Mesh Provisioning

No fix information.

CVE-2020-26557: kernel: predictable Authvalue in Bluetooth Mesh
Provisioning Leads to MITM

No fix information.

CVE-2020-26559: kernel: Authvalue leak in Bluetooth Mesh Provisioning

No fix information.

CVE-2020-26560: kernel: impersonation attack in Bluetooth Mesh Provisioning

No fix information.

Regards,
-- 
Masami Ichikawa
Cybertrust Japan Co., Ltd.

Email :masami.ichikawa@cybertrust.co.jp
      :masami.ichikawa@miraclelinux.com