QID 198659

The rlimit tracking for user namespaces in the linuxkernel did not properly perform reference counting, leading to a use-after-free vulnerability.
The bpf verifier in the linux kernel did notproperly restrict pointer types in certain situations.
Use-after-free in the nouveau graphics driver ofthe linux kernel during device removal.
The packet network protocol implementation in thelinux kernel contained a double-free vulnerability.
The xen subsystem within the linux kernel didnot adequately limit the number of events driver domains (unprivileged pvbackends) could send to other guest vms.
The xen network backend driver in the linuxkernel did not adequately limit the amount of queued packets when a guestdid not process them.
The usb gadget subsystem in the linuxkernel did not properly restrict the size of control requests for certaingadget types, leading to possible out of bounds reads or writes.
The ebpf implementation in the linux kernelcontained a race condition around read-only maps.
Race condition in the unix domain socketimplementation in the linux kernel that could result in a read-after-free.
The simulated networking device driver for the linuxkernel did not properly initialize memory in certain situations.
The xfs file system implementation in thelinux kernel did not calculate size correctly when pre-allocating space insome situations.
The cgroup process migration implementationin the linux kernel did not perform permission checks correctly in somesituations.
The aquantia aqtion ethernet devicedriver in the linux kernel did not properly validate meta-data coming fromthe device.
The arm trusted execution environment (tee)subsystem in the linux kernel contained a race condition leading to a use-after-free vulnerability.
The phone network protocol (phonet) implementationin the linux kernel did not properly perform reference counting in someerror conditions.

A local attacker could use this to cause a denial ofservice or possibly execute arbitrary code.
A local attackercould use this to cause a denial of service (system crash) or possiblyexecute arbitrary code.
A privileged or physicallyproximate attacker could use this to cause a denial of service (systemcrash).
A local attacker coulduse this to cause a denial of service (system crash) or possibly executearbitrary code.
An attacker in a driver domaincould use this to cause a denial of service in other guest vms.
An attacker in a guest vm can use this to cause adenial of service (excessive kernel memory consumption) in the networkbackend domain.
A localattacker could use this to cause a denial of service (system crash) orpossibly execute arbitrary code.
A privileged attackercould use this to modify read-only maps.
A local attacker could use this to cause a denial of service (system crash)or possibly execute arbitrary code.
A localattacker could use this to expose sensitive information (kernel memory).
A local attacker could use this to expose sensitiveinformation.
A local attacker could possibly use this to gain administrativeprivileges.
A local attacker who can control an emulated device can usethis to cause a denial of service (system crash) or possibly executearbitrary code.
A local attacker could use this to cause a denialof service or possibly execute arbitrary code.
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A local attacker could use this to expose sensitive information (kernelpointer addresses).
Alocal attacker could use this to cause a denial of service or possiblyexecute arbitrary code.
A local attackercould use this to expose sensitive information (kernel memory).
A local attacker could use this toexpose sensitive information or possibly gain administrative privileges.