Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: Fixed the issue where f2fswaitonpagewriteback was called in f2fswriterawpages. A BUG will be triggered when writing files concurrently, because the same page may be written back multiple times. The bug occurs at...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in psi/zcolor.c in Artifex Ghostscript prior to version 10.04.0. There is a buffer overflow vulnerability when reading colors from the indexed color space...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ARM: 9381/1: kasan: cleared stale stack poison We have identified the following OOB crash: 33.452494 ================================================================== 33.453513 BUG: KASAN: stack-out-of-bounds in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of BUGENTRY. When CONFIGDEBUGBUGVERBOSE=n, we fail to add the necessary padding bytes to the bugtable entries. As a result, the last entry in a bug table will be ignored, potentially leadin...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm6: Check the return value of ip6dstidev in xfrm6getsaddr. ip6dstidev can return NULL, and xfrm6getsaddr must act accordingly. syzbot reported: Oops: General protection fault, likely due to a non-canonical address...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: Handling of inconsistent states in nilfsbtnodecreateblock. Syzbot reported that an inconsistency in the buffer state was detected in nilfsbtnodecreateblock, which triggered a kernel bug. It is not appropriate to consider...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1 No skb has been created yet. 2 headersize == 0 no SHAMPO header. 3 headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 this is the last page fragment o...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Fixed a kernel bug caused by failing to clear the buffer delay flag. Syzbot reported that after Nilfs2 reads a corrupted file system image and becomes read-only, the BUGON check for the buffer delay flag in submitbhwbc ma...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Fixed the memory leak in resetmethodstore In resetmethodstore, a string is allocated via kstrndup and assigned to the local variable “options”. Then, options is used with strsep to find spaces: c while name = strsep&options,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoided potential dereferencing of error pointers in stihqvdpatomiccheck. The return value of drmatomicgetcrtcstate needs to be checked. This is done to avoid using the error pointer ‘crtcstate’ in case of a failure...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault in the function irraweventstorewithfilter. This crash occurs due to a NULL pointer dereference of the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ath11k: fixed the netdev open race condition. Make sure to allocate the necessary resources before registering the device. This specifically prevents a race condition where open triggers a BUGON in modtimer, when ath11kmacopstart...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Block, bfq: Fixed a possible Use After Free UAF for ‘bfqq-bic’. Our test report identified a UAF for ‘bfqq-bic’ in 5.10: Bug: KASAN: Use After Free in bfqselectqueue+0x378/0xa30 CPU: 6 PID: 2318352 Comm: fsstress Kdump: Loaded; N...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed an invalid free of JFSIPipimap-iimap in diUnmount. syzbot detected an invalid-free in diUnmount: BUG: KASAN: double-free in slabfree mm/slub.c:3661 inline BUG: KASAN: double-free in kmemcachefree+0x71/0x110...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers reported memory safety bugs in Firefox 88 and Firefox ESR 78.11. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...

Astra Linux – Vulnerability in Squid

A issue was discovered in Squid before version 4.15 and 5.x before version 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack targeting all clients using the proxy. A client sends an HTTP Range request to trigger this vulnerability...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not blindly read the IP address in ftracebug. It was reported that a bug in arm64 caused a bad IP address to be used for updating a NOP instruction in ftraceinit. However, the error path correctly returned -EINVAL...

Astra Linux - Vulnerability in golang-gogoprotobuf

A issue was discovered in GoGo Protobuf before version 1.3.2. The plugin/unmarshal/unmarshal.go file lacks certain index validations, also known as the “skippy peanut butter” issue...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: media: ngene: Fixed a out-of-bounds bug in ngenuecommandconfigfreebuf. Fixed a 11-year-old bug in ngenuecommandconfigfreebuf by addressing the following warnings detected by -Warray-bounds: arch/alpha/include/asm/string.h:22:1...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate-data before returning from skbtunnelinfo The skbtunnelinfo function returns a pointer to lwtstate-data without validation. lwtstate-data can have various types, such as mplsiptunnelencap, etc., and these...