kernel: when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds

When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.

libtar: out-of-bounds read in gnu_longlink

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.

libtar: memory leak found in th_read() function

The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.

libtar: memory leak found in th_read() function

The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.

libtar: out-of-bounds read in gnu_longname

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

NULL-ptr-deref in network sched

NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C. This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.

libtar: fixes for CVE-2021-33645 and CVE-2021-33646 introduced new use-after-free bugs in libtar

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Kernel crash in EXT4 filesystem

Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.

atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.

REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.