QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service DoS attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline...

DEBIAN-CVE-2024-50277

In the Linux kernel, the following vulnerability has been resolved: dm: fix a crash if blkallocdisk fails If blkallocdisk fails, the variable md-disk is set to an error value. cleanupmappeddevice will see that md-disk is non-NULL and it will attempt to access it, causing a crash on this statement...

AZL-53751 CVE-2024-50277 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: dm: fix a crash if blkallocdisk fails If blkallocdisk fails, the variable md-disk is set to an error value. cleanupmappeddevice will see that md-disk is non-NULL and it will attempt to access it, causing a crash on this statement...

PT-2024-35629

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0 Description A slab-use-after-free issue has been identified in the Linux kernel. The issue arises from the association of the bic with sync bfqq and the inability to put bfq release process ref into bfq pu...

The vulnerability of the nbd component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the nbd component in the Linux operating system’s kernel is related to improper error handling in the nbdgenlstatus function. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: block: fix overflow in blk_ioctl_discard()

In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blkioctldiscard There is no check for overflow of 'start + len' in blkioctldiscard. Hung task occurs if submit an discard ioctl with the following param: start = 0x80000000000ff000, len = 0x8000000000fff000...

kernel: block: refine the EOF check in blkdev_iomap_begin

In the Linux kernel, the following vulnerability has been resolved: block: refine the EOF check in blkdeviomapbegin blkdeviomapbegin rounds down the offset to the logical block size before stashing it in iomap-offset and checking that it still is inside the inode size. Check the isize check to th...

kernel: nbd: always initialize struct msghdr completely

In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg-msggetinq value can be uninitialized 1 struct msghdr got many new fields recently, we should always make sure their values is zero by default. 1 BUG: KMSAN...

kernel: block: fix module reference leakage from bdev_open_by_dev error path

In the Linux kernel, the following vulnerability has been resolved: block: fix module reference leakage from bdevopenbydev error path The Linux kernel CVE team has assigned CVE-2024-35859 to this issue. Upstream advisory:...

DEBIAN-CVE-2024-50217

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in btrfsfreeextradevids Mounting btrfs from two images which have the same one fsid and two different devuuids in certain executing order may trigger an UAF for variable...

UBUNTU-CVE-2024-50217

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in btrfsfreeextradevids Mounting btrfs from two images which have the same one fsid and two different devuuids in certain executing order may trigger an UAF for variable...

CVE-2024-50217 btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in btrfsfreeextradevids Mounting btrfs from two images which have the same one fsid and two different devuuids in certain executing order may trigger an UAF for variable...

CVE-2024-50217

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in btrfsfreeextradevids Mounting btrfs from two images which have the same one fsid and two different devuuids in certain executing order may trigger an UAF for variable...

nbd: fix race between timeout and normal completion

...

CVE-2024-50217: Use After Free

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in btrfsfreeextradevids Mounting btrfs from two images which have the same one fsid and two different devuuids in certain executing order may trigger an UAF for variable...

Security update for qemu

This update for qemu fixes the following issues: CVE-2024-8354: Fixed assertion failure in usbepget bsc1230834. CVE-2024-8612: Fixed nformation leak in virtio devices bsc1230915. CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure bsc122900...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:3472)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3472 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:3470)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3470 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

SUSE CVE-2024-50080

In the Linux kernel, the following vulnerability has been resolved: ublk: don't allow user copy for unprivileged device UBLKFUSERCOPY requires userspace to call write on ublk char device for filling request buffer, and unprivileged device can't be trusted. So don't allow user copy for unprivilege...

SUSE CVE-2024-49959

In the Linux kernel, the following vulnerability has been resolved: jbd2: stop waiting for space when jbd2cleanupjournaltail returns error In jbd2logwaitforspace, we might call jbd2cleanupjournaltail to recover some journal space. But if an error occurs while executing jbd2cleanupjournaltail e.g....