UBUNTU-CVE-2022-50308

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devmkcalloc As the devmkcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference...

UBUNTU-CVE-2023-53199

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: clean up skbs if ath9khifusbrxstream fails Syzkaller detected a memory leak of skbs in ath9khifusbrxstream. While processing skbs in ath9khifusbrxstream, the already allocated skbs in skbpool are not freed if...

UBUNTU-CVE-2022-50294

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbsinitadapter When kfifoalloc failed in lbsinitadapter, cmd buffer is not released. Add free memory to processing error path...

UBUNTU-CVE-2022-50326

In the Linux kernel, the following vulnerability has been resolved: media: airspy: fix memory leak in airspy probe The commit ca9dc8d06ab6 "media: airspy: respect the DMA coherency rules" moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing...

CVE-2022-50338

The CVE-2022-50338 entry concerns a Linux kernel binder UAF in a race between binder_update_page_range() and munmap() that can access alloc->vma after it is freed. Affected component: kernel Binder in Linux kernel (stable branches 5.4 and 5.10). Root cause: improper locking around mmap/vma han...

CVE-2022-50335 9p: set req refcount to zero to avoid uninitialized usage

In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized usage When a new request is allocated, the refcount will be zero if it is reused, but if the request is newly allocated from slab, it is not fully initialized before being added...

CVE-2022-50326 media: airspy: fix memory leak in airspy probe

In the Linux kernel, the following vulnerability has been resolved: media: airspy: fix memory leak in airspy probe The commit ca9dc8d06ab6 "media: airspy: respect the DMA coherency rules" moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to insufficient bounds checking on the authorization header. An attacker can cause excessive memory allocation by sending specially crafted requests, potentially leading to servic...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to insufficient bounds checking on the authorization header. An attacker can cause excessive memory allocation by sending specially crafted requests, potentially leading to servic...

CVE-2023-53253 HID: nvidia-shield: Reference hid_device devm allocation of input_dev name

In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hiddevice devm allocation of inputdev name Use hiddevice for devm allocation of the inputdev name to avoid a use-after-free. inputunregisterdevice would trigger devres cleanup of all resources...

CVE-2023-53253

CVE-2023-53253 affects the Linux kernel HID path for nvidia-shield. The underlying issue is a use-after-free caused by freeing the input_dev name during input_dev unregister, when the name is freed by devres cleanup via input_unregister_device. The mitigation described in the public records is to...

CVE-2023-53253 HID: nvidia-shield: Reference hid_device devm allocation of input_dev name

In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hiddevice devm allocation of inputdev name Use hiddevice for devm allocation of the inputdev name to avoid a use-after-free. inputunregisterdevice would trigger devres cleanup of all resources...

CVE-2023-53244 media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

CVE-2023-53244 media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

CVE-2023-53243 btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile

In the Linux kernel, the following vulnerability has been resolved: btrfs: add handling for RAID1C23/DUP to btrfsreduceallocprofile Callers of btrfsreduceallocprofile expect it to return exactly one allocation profile flag, and failing to do so may ultimately result in a WARNON and remount-ro whe...

CVE-2023-53243 btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile

In the Linux kernel, the following vulnerability has been resolved: btrfs: add handling for RAID1C23/DUP to btrfsreduceallocprofile Callers of btrfsreduceallocprofile expect it to return exactly one allocation profile flag, and failing to do so may ultimately result in a WARNON and remount-ro whe...

CVE-2022-50294 wifi: libertas: fix memory leak in lbs_init_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbsinitadapter When kfifoalloc failed in lbsinitadapter, cmd buffer is not released. Add free memory to processing error path...

CVE-2022-50294 wifi: libertas: fix memory leak in lbs_init_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbsinitadapter When kfifoalloc failed in lbsinitadapter, cmd buffer is not released. Add free memory to processing error path...

CVE-2022-50293

CVE-2022-50293 affects the Linux kernel btrfs subsystem. When dropping file extent items for a range, ENOMEM could trigger a BUG_ON() path in btrfs_drop_extents(); the fix replaces those BUG_ON()s with proper transaction abort and error return handling. This means that instead of halting the tran...

CVE-2022-50293 btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUGON on ENOMEM when dropping extent items for a range If we get -ENOMEM while dropping file extent items in a given range, at btrfsdropextents, due to failure to allocate memory when attempting to increment the...