Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: reg: Check the return value after calling platformgetresource. This issue could lead to a null-ptr-deref in resourcesize if platformgetresource returns NULL. Moving the call to resourcesize after devmioremapresource wil...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host – Added an alignment check for the event ring read pointer. Although we check the event ring read pointer using “isvalidringptr” to ensure it is within the buffer range, there is another risk that the pointer might...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a stack buffer overflow issue in ImageMagick’s morphology kernel parsing functions. User-controlled kernel strings that exceeded the buffer size were...

Astra Linux – Vulnerability in Linux 5.15

The function rpmsgvirtioaddctrldev in the file drivers/rpmsg/virtiorpmsgbus.c in the Linux kernel, prior to version 5.18.4, contains a double-free...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rxrpc: a reference count leak was fixed in rxrpcserverkeyring. This patch addresses the reference count leak in rxrpcserverkeyring by checking whether rx-securities has already been set...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: exfat: Use kvmallocarray/kvfree instead of kmallocarray/kfree. The call stack shown below represents a scenario in the Linux 4.19 kernel. Memory allocation failed for the exfat file system, due to system memory fragmentation...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net: bcmgenet: Use stronger register read/writes to ensure proper ordering. GCC12 seems to be much more efficient in tracking dependencies. It recognizes that relaxed variants are merely normal loads and stores, which is causi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fixed a possible deadlock in macbhalttx. There is a situation where, after THALT is set to a high value, TGO also remains high. Since the jiffies values are never updated, and we are in a context with interrup...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netrom: Decreases the sock refcount when the sock timer expires. The commit 63346650c1a9 “netrom: switch to the sock timer API” switched to using the sock timer API. This replaced modtimer with skresettimer, and deltimer with...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: A buffer overflow bug has been fixed in ismtaccess. When the driver does not check the data from the user, the variable ‘data-block0’ may become very large, leading to a buffer overflow bug. The following log can revea...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: blk-iolatency: Fixed imbalances in the number of in-flight IO operations and issues with hanging during offline conditions. iolatency needs to track the number of in-flight IO operations per cgroup. Since this tracking can be...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Added error handling to pairdevice. The hciconnparamsadd function never checks for a NULL value, which could lead to a NULL pointer dereferencing and resulting in a crash. This issue has been fixed by adding erro...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winchhandlers before registering the winchIRQ. Registering a winchIRQ can lead to a race condition; an interrupt may occur before the winch is added to the winchhandlers list. If this happens, registerwinchirq ad...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a slab-use-after-free in ext4splitextentat. We encountered the following use-after-free issues: BUG: KASAN: slab-use-after-free in ext4splitextentat+0xba8/0xcc0 Read of size 2 at addr ffff88810548ed08 by task...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert to the previous state where “ACPICA: Avoid Info: Mapping Multiple BARs. Your Kernel Is Fine”. Undo the modifications made in the commit d410ee5109a1 “ACPICA: Avoid “Info: Mapping Multiple BARs. Your Kernel Is Fine”...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nouveau: fixed a race condition related to ptr storage operations. When running many VK CTS tests in parallel against nouveau, every few hours, you might encounter a crash like this. BUG: Kernel NULL pointer dereferencing, addres...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: Kyber: An out-of-bounds access issue occurs when the thread is preempted. The function blkmqschedbiomerge retrieves the ctx and hctx for the current CPU and passes the hctx to -biomerge. The function kyberbiomerge then retrieves...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices The probe function is only used for the DP83822 PHY; the private data pointer remains uninitialized for the smaller DP83825/26 models. While all uses of the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed cmd-req.sg when the PDU length or offset exceeded sgcnt, and then use bogus values of sg-length/offset. This led to...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: cyapa – add missing input core locking to suspend/resume functions. Lock the “grabinput” mutex during suspend/resume functions, just as it is done in other input drivers. This fixes the following warning during system...