Microsoft Office Excel Remote Code Execution Vulnerability

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.

FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST

FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.

wifi: mac80211: fix fils_discovery double free on alloc failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.fils_discovery still points at the object already queued for freeing. A later update or AP teardown (ieee80211_stop_ap()) re-queues that same rcu_head; the second free is caught by KASAN when the RCU sheaf is processed in softirq: BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr ffff88800c065280 by task swapper/0/0 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940) rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-96 of size 96 Queue the old object for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().

Windows Message Queuing Remote Code Execution Vulnerability

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Windows Image Acquisition Remote Code Execution Vulnerability

Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.

In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.

Windows TCP/IP Elevation of Privilege Vulnerability

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Windows Diagnostic Policy Service Elevation of Privilege Vulnerability

Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

Windows DHCP Client Elevation of Privilege Vulnerability

Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.

Windows USB Video Driver Elevation of Privilege Vulnerability

Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

Windows Error Reporting Elevation of Privilege Vulnerability

Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

wifi: ath11k: fix warning when unbinding

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is unbinded (ath11k_pci), and we get: WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90 Call Trace: free_large_kmalloc ath11k_dp_free ath11k_core_deinit ath11k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free.

Double free after allocation failure in regcomp and regexec

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Windows CredSSP Remote Code Execution Vulnerability

Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.

Windows Message Queuing Remote Code Execution Vulnerability

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.