Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Net: Ethernet: mtk-star-emac: fixed spinlock recursion issues during rx/tx polls. Use spinlockirqsave and spinunlockirqrestore instead of spinlock and spinunlock in the mtk-star-emac driver to avoid spinlock recursion issues...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: null – Use spin locks instead of mutexes. Since the null algorithm may be freed in the softirq context through afalg, using spin locks instead of mutexes helps protect the default null algorithm...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: sound/virtio: Fixed warnings related to cancelsync on uninitialized workstructs. Betty reported encountering the following warning: 8.709131 T221 WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182 ... 8.713282 T221 Call trace:...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Added a check for the return value of spiimxsetupxfer. The function pointers spiimx-rx and spiimx-tx can be NULL when spiimxsetupxfer returns an error, and NULL pointers should not be dereferenced. It is not possibl...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit the printed string from the FW file. There is no guarantee that the file always has a NUL-termination; therefore, reading the string may go beyond the end of the TLV. If that is the last TLV in the file, it...

Astra Linux – Vulnerability in Intel Microcode

Incorrect default permissions in some IntelR XeonR processor memory controller configurations when using IntelR SGX may allow a privileged user to potentially enable escalation of privileges through local access...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graph-based media-handling components. A null pointer dereference vulnerability has been discovered in the gstjpegdecnegotiate function in gstjpegdec.c. This function does not check for a NULL return value from gstvideodecodersetoutputstate. When this occur...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to the cacheinfo array The loop that detects/populates cache information already includes a check on the array size. However, it does not take into account cache levels with separate...

Astra Linux – Vulnerability in Chromium

Before version 134.0.6998.35, using “After Free” in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Intel Microcode

The exposure of sensitive information due to shared microarchitectural predictor states, which affect transient execution on some Intel AtomR processors, may allow an authenticated user to potentially disclose information through local access...

Astra Linux – Vulnerability in Intel Microcode

Incorrect initialization of resources in the branch prediction unit of some IntelR Core™ Ultra Processors may allow an authenticated user to potentially disclose information through local access...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Check the changespktdata property for extension programs. When processing calls to global sub-programs, the verifier decides whether to invalidate all packet pointers in the current state, depending on the changespktdata...

Astra Linux – Vulnerability in OpenSSL

Issue summary: Clients that use RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because the handshake does not abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections that use raw...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rtomin/max: Avoid using current-nsproxy. As mentioned in a previous commit of this series, using the net structure via current is not recommended for various reasons: - Inconsistency: Obtaining information from the...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A flaw was discovered in libsoup, where the soupmultipartnewfrommessage function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read data beyond its intended range...

Astra Linux – Vulnerability in libsoup3

A flaw was discovered in libsoup. The HTTP/2 server in libsoup may not fully validate the values of the pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a Denial of Service DoS attack...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: The dummy regulator must be checked before being used. Due to asynchronous driver probing, there is a possibility that the dummy regulator may not have been checked when accessed for the first time...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. A use-after-free vulnerability has been discovered, affecting the processing of CodecPrivate elements in Matroska streams. In the GSTMATROSKAIDCODECPRIVATE case, within the gstmatroskademuxparsestream function, a data...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: The denominator “cbrpipes” must not be 0; it is checked before being used. WHAT & HOW The denominator cannot be 0, and is checked before being used. This fix addresses two “DIVIDEBYZERO” issues reported by...

Astra Linux – Vulnerability in procps

Under certain circumstances, this weakness allows a user who has access to run the “ps” utility on a machine to write almost unlimited amounts of unfiltered data into the process heap...