Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Network layer: Do not leave a dangling “sk” pointer when socket creation fails. It is possible to trigger a use-after-free by: - Attaching a “fentry” probe to sockrelease and the probe that calls bpfgetsocketcookie; - Running...

PT-2026-51731

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the BPF Berkeley Packet Filter subsystem. The function bpf selem unlink nofail sets the smap variable to NULL before removing the element from the...

CVE-2023-53585 bpf: reject unhashed sockets in bpf_sk_assign

In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in bpfskassign The semantics for bpfskassign are as follows: sk = somelookupfunc bpfskassignskb, sk bpfskreleasesk That is, the sk is not consumed by bpfskassign. The function therefore needs to make...

kernel: bpf: reject unhashed sockets in bpf_sk_assign

A reference counting flaw was found in the Linux kernel's BPF socket assignment helper when handling unhashed UDP sockets. When a BPF program assigns an unhashed UDP socket to a packet, the function increments the socket reference count assuming SOCKRCUFREE isn't set. However, subsequent bind or...

CVE-2023-52523 bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject skmsg egress redirects to non-TCP sockets With a SOCKMAP/SOCKHASH map and an skmsg program user can steer messages sent from one TCP socket s1 to actually egress from another TCP socket s2: tcpbpfsendmsgs1 //...

kernel: bpf: reject unhashed sockets in bpf_sk_assign

A reference counting flaw was found in the Linux kernel's BPF socket assignment helper when handling unhashed UDP sockets. When a BPF program assigns an unhashed UDP socket to a packet, the function increments the socket reference count assuming SOCKRCUFREE isn't set. However, subsequent bind or...