Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm cache: Prevent BUGON by blocking retries on devices where the resume operation fails due to mapping errors. A cache device that fails to resume due to mapping errors should not be retried, as this will leave a partially...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: BUG: KASAN: Slab-out-of-bounds in crc32body lib/crc32.c:111 inline BUG: KASAN: Slab-out-of-bounds in crc32legeneric lib/crc32.c:179 inline BUG: KASAN: Slab-out-of-bounds in crc32lebase+0x58c/0x626 lib/crc32.c:197 A read of siz...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/code-patching: Fixed a KASAN vulnerability by not marking the text patching area as a VMALLOC. Erhard reported the following KASAN vulnerabilities while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6: -...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a use-after-free issue in ext4findextent when using bigalloc with inline data. Syzbot identified the following issue: - loop0: A change in capacity was detected, from 0 to 2048. - EXT4-fs loop0: The filesystem...

Astra Linux – Vulnerability in openimageio

There is a heap out-of-bounds read vulnerability in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially crafted .psd file can cause a read of arbitrary memory addresses, leading to a denial of service attack. An attacker can provide a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: writeback: Fixed a use-after-free issue in markinodedirty. A use-after-free issue occurred when markinodedirty accessed bdiwriteback, which was in progress during the switch operation. CPU: 1, PID: 562, Comm: systemd-random-N...

Astra Linux - Vulnerability in libstb

stbvorbis is a single-file library licensed under the MIT License for processing Ogg Vorbis files. A specially crafted file may trigger an out-of-bounds write in f-vendorlen = char'\0';. The root cause is that if the len value read in startdecoder is -1, len + 1 becomes 0 when passed to...

Astra Linux – Vulnerability in Firefox

A memory safety bug has been fixed in Firefox 152. This vulnerability was addressed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Signal: Allocate SSVE storage when restoring ZA The code used to restore a ZA context does not attempt to allocate the task’s svestate before setting TIFSME. As a result, restoring a ZA context may place the task in...

Astra Linux – Vulnerability in Linux 5.10

The nftablesnewset function in net/netfilter/nftablesapi.c in the Linux kernel before version 5.12.13 allows local users to cause a denial of service due to NULL pointer dereferencing and general protection faults, caused by the absence of initialization for nftsetelemexpralloc. A local user can...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fixed a possible null-ptr-deref issue when assigning a stream. While AudioDSP drivers assign streams that are exclusively of HOST or LINK type, nothing prevents a user from attempting to assign a COUPLED stream. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed an invalid free of JFSIPipimap-iimap in diUnmount. syzbot detected an invalid-free in diUnmount: BUG: KASAN: double-free in slabfree mm/slub.c:3661 inline BUG: KASAN: double-free in kmemcachefree+0x71/0x110...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.77, TabStrip in Google Chrome allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory write through a crafted HTML page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: wd33c93: Do not use an outdated SCSI pointer value. A regression was introduced with the commit dbb2da557a6a “scsi: wd33c93: Move the SCSI pointer to private command data”, which resulted in a buffer overflow error in...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ARM: 9381/1: kasan: cleared stale stack poison We have identified the following OOB crash: 33.452494 ================================================================== 33.453513 BUG: KASAN: stack-out-of-bounds in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netem: fixed the return value if duplicate enqueue fails. There is a bug in netemenqueue, introduced by the commit 5845f706388a “net: netem: fix skb length BUGON in skbtosgvec”, which can lead to a use-after-free. This commit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Fixed a kernel bug caused by failing to clear the buffer delay flag. Syzbot reported that after Nilfs2 reads a corrupted file system image and becomes read-only, the BUGON check for the buffer delay flag in submitbhwbc ma...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: xfs: Fixed undersized liclogroundoff values. If the superblock does not list a log stripe unit, we set the incore log roundoff value to 512. This can lead to corrupted logs and unmountable file systems in generic/617 on a disk...

Astra Linux – Vulnerability in gstreamer1.0, gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemuxparsetheoraextension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...