The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. It was introduced via 457f44363a88 ('bpf: Implement BPF ring buffer and verifier support for it') (v5.8-rc1).

This issue was fixed via commit 4b81ccebaeee ('bpf, ringbuf: Deny reserve of buffers larger than ringbuf') (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37.

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration this is commonly referred to as Server-Side Request Forgery (SSRF).Īn authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated. Aom_dsp/noise_model.c in libaom in AOMedia before has a buffer overflow.

Gameloop 4.1 21.90 download