CVE-2024-35887

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

CVE-2024-35887 ax25: fix use-after-free bugs caused by ax25_ds_del_timer

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

CVE-2024-35887 ax25: fix use-after-free bugs caused by ax25_ds_del_timer

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

CVE-2024-35887

CVE-2024-35887 affects the Linux kernel ax25 subsystem. When an ax25 device detaches, ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer; if the timer handler is running, del_timer() may run concurrently with ax25_dev_put() freeing the device, causing a use-after-free. Th...

CVE-2024-35887 ax25: fix use-after-free bugs caused by ax25_ds_del_timer

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

PT-2024-28068

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak issue exists in the ax25 dev device down function, which can cause a memory leak when the ax25 device is shutting down. The issue arises because the ax25 dev devic...

PT-2024-26845

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A vulnerability has been resolved in the Linux kernel, specifically in the ax25 module, which handles Amateur Radio AX.25 packet protocol. The issue is related to a netdev refcount problem. Whe...

Null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: hamradio: improve the incomplete fix to avoid NPD The previous commit 3e0588c291d6 "hamradio: defer ax25 kfree after unregisternetdev" reorder the kfree operations and unregisternetdev operation to prevent UAF. This commit improv...

Race condition

In the Linux kernel, the following vulnerability has been resolved: hamradio: defer ax25 kfree after unregisternetdev There is a possible race condition use-after-free like below USE | FREE ax25sendmsg | ax25queuexmit | devqueuexmit | devqueuexmit | devxmitskb | schdirectxmit | ... xmitone |...

CVE-2021-47084

CVE-2021-47084 is rejected/not used per the initial description.

CVE-2021-47084

Removed by vendor...

CLSA-2023-1682605601 Fix of 53 CVEs

CVE-2022-1198 - drivers: hamradio: 6pack: fix UAF bug caused by modtimer Bionic update: upstream stable patchset 2022-03-04 LP: 1963717 // CVE-2020-36516 - ipv4: avoid using shared IP generator for connected sockets CVE-2022-36879 - xfrm: xfrmpolicy: fix a possible double xfrmpolsput in...

CLSA-2023-1682604577 Fix of 53 CVEs

CVE-2022-1198 - drivers: hamradio: 6pack: fix UAF bug caused by modtimer Bionic update: upstream stable patchset 2022-03-04 LP: 1963717 // CVE-2020-36516 - ipv4: avoid using shared IP generator for connected sockets CVE-2022-36879 - xfrm: xfrmpolicy: fix a possible double xfrmpolsput in...

SUSE CVE-2009-2909

Integer signedness error in the ax25setsockopt function in net/ax25/afax25.c in the ax25 subsystem in the Linux kernel before 2.6.31.2 allows local users to cause a denial of service OOPS via a crafted optlen value in an SOBINDTODEVICE operation...

SUSE CVE-2010-3875

The ax25getname function in net/ax25/afax25.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure...

SUSE CVE-2013-3223

The ax25recvmsg function in net/ax25/afax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call...

SUSE CVE-2019-17052

ax25create in net/ax25/afax25.c in the AFAX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAPNETRAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768...

SUSE CVE-2022-1198

A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space...

GSD-2022-1005276 ax25: fix incorrect dev_tracker usage

ax25: fix incorrect devtracker usage This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit 4294df1374450912b2f64ee3cf575069fc784679,...

PT-2022-33534 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.17 through v5.19.1 Description: The issue is related to incorrect dev tracker usage in ax25. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5.17 and fixed in Linux...