Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: drivers: dio: A possible memory leak has been fixed in dioinit. If deviceregister returns an error, the dev object and its associated name need to be freed. Add a release function, and then call putdevice in the error handling...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: A UAF bug was fixed in the error path of the probing process. When the driver fails in sndcardregister during the probing phase, it will free the bcd2k-midiouturb before terminating it, which could lead to a UAF bu...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nvme-tcp: fixed a possible use-after-free issue in the transport errorrecovery process. While nvmetcpsubmitasynceventwork checks the ctrl and queue states before preparing the AER command and scheduling iowork, this check is...

Astra Linux – Vulnerability in u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation with a failed length check at nfslookupreply...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A issue was discovered in the Linux kernel through version 6.1-rc8. The function dpucrtcatomiccheck in the file drivers/gpu/drm/msm/disp/dpu1/dpucrtc.c lacks a check for the return value of kzalloc. This issue may lead to a NULL Pointer Dereference...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ceph: Fixed inode reference leakage in cephgetsnapdir The cephgetinode function will search for or insert a new inode into the hash for the given vino, and return a reference to it. If new is non-NULL, its reference is consumed. ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: isdn: mISDN: Fixed the sleeping function called from an invalid context. The driver can call the card-isac.release function from an atomic context. This issue was fixed by calling this function after releasing the lock. The...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: exynos-ppmu: Fixed a refcount leak in the ofgetdevfreqevents function. The ofgetchildbyname function returns a node pointer with a refcount incremented. We should use ofnodeput on this pointer after execution. This...

Astra Linux – Vulnerability in Golang-1.19

Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Moreover, the error string is created through repeated string concatenation, resulting in quadratic runtime. Therefore, a certificate provided by a malicious actor can...

Astra Linux – Vulnerability in Parsec

The vulnerability of the parsecmdlin function in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 5.15, Linux

In the Linux kernel, the following vulnerability has been resolved: cxl: Fixed the refcount leak in cxlcalccapprouting. The ofgetnextparent function returns a node pointer with the refcount incremented. We should use ofnodeput on it when it is no longer needed. This function only calls ofnodeput ...

Astra Linux – Vulnerability in OVN

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header’s self-declared total length iptotlen for IPv4, ip6plen for IPv6, without validating it against the actual packet buffer siz...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp3x-rt5682-max9836: Added missing error checks for clock acquisition. The acp3x5682init function did not check the return value of clkget, which could lead to dereferencing error pointers in rt5682clkenable. This iss...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Driver Core: Fixed a potential nullptrderef in deviceadd. I encountered the following nullptrderef during fault injection testing: BUG: NULL pointer dereferencing in the kernel. Address: 0000000000000058 CPU: 2 PID: 278 Comm:...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: fixed the issue where the reference count of nfsd4sscumountitem was leaked. The reference count of nfsd4sscumountitem is not decremented under error conditions. This prevents the laundromat from unmounting the vfsmount of t...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: fix memleak on platformdeviceadd fails No error handling is performed when platformdeviceadd fails. Error processing should be added before returning from the function, and the return value has been modified...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu/gfx: Disable gfx9 cpeccerrorirq only when enabling legacy gfx ras. gfx9 cpeccerrorirq is only enabled when legacy gfx ras is asserted. Therefore, in gfxv90hwfini, the interrupt disabling for cpeccerrorirq should be...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: Do not delete the error page from the page cache. This change is very similar to the change made for shmem 1. It addresses the same issue, but for the HugeTLBFS mechanism instead. Currently, when a poisoned HugeTLB pag...

Astra Linux – Vulnerability in Parsec

The vulnerability of the pdpl-user utility in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.52 and earlier fail to close inbound connections when errors occur during the discarding of the request body, exposing the server to HTTP Request Smuggling attacks...