Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: openvswitch: Fixed a race condition related to port output. Assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows. 2. Two network namespaces: “server” and “client”. 3...

Astra Linux – Vulnerability found in Python 3.11, Python 2.7, and Python 3.7

There is a low-severity vulnerability affecting CPython, specifically the ‘http.cookies’ standard library module. When parsing cookies where quotes were represented by backslashes in the cookie value, the parser uses an algorithm with quadratic complexity, resulting in excessive CPU resources bei...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfconncount: The struct nfconncounttuple was fully initialized in the inserttree function. Since the commit b36e4523d4d5 “netfilter: nfconncount: fix garbage collection confirm race”, the cpu and jiffies32 fields we...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/cpumsf: Handling of CPU hotplug removal during sampling The handling of CPU hotplug removal triggers the following function calls: CPUHPAPPERFS390SFONLINE -- s390pmusfofflinecpu ... CPUHPAPPERFONLINE -- perfeventexitcpu The...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: spi: Fixed a use-after-free issue during controller registration failures. Be sure to also deregister from the driver core in case the per-cpu statistics allocation fails during controller registration, in order to avoid...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fixed the imbalance in schedsmtpresent. I received the following warning during the stress test: jump label: negative count! WARNING: CPU: 3, PID: 38, at kernel/jumplabel.c:263, statickeyslowtrydec+0x9d/0xb0 Call Trace...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: rcutorture: Fixed the issue where ksoftirqd’s timing and iteration were increased. The RCU priority boosting can fail in two situations: 1 If nrcpus maxcpus, meaning that the total number of CPUs is greater than the number of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: MIPS: cpuinfo: Fixed a warning for CONFIGCPUMASKOFFSTACK When CONFIGCPUMASKOFFSTACK and CONFIGDEBUGPERCPUMAPS are selected, cpumaxbitswarn generates a runtime warning similar to the following, while we display /proc/cpuinfo. This...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: remove the cpuhp instance node before removing the cpuhp state The functions cpuhpstateaddinstance and cpuhpstateremoveinstance should be used in pairs. Otherwise, a warning will be issued when calling...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed a potential deadlock in CPU hotplug with osnoise. The following sequence may lead to a deadlock in CPU hotplug: task1 task2 task3 ----- ----- ----- mutexlock&interfacelock CPU GOING OFFLINE cpuswritelock;...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: armsdei: Fixed a bug where sleep operations occurred from an invalid context. Running a preempt-rt v6.2-rc3-rt1 based kernel on an Ampere Altra Triggers: - Bug: Sleeping function called from an invalid context at...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RCU: Fixed the lockdep warning in thiscpuread in rcuforcequiescentstate. Running rcutorture with a non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following error: BUG: Using...

Astra Linux – Vulnerability in Netty

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user could trigger a Denial of Service DoS attack on a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server lacks a limit on the number of...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper limit on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal...

Astra Linux – Vulnerability in exiv2

In Jp2Image::readMetadata in jp2image.cpp in Exiv2 0.27.2, an input file may lead to an infinite loop and system hangs, accompanied by high CPU consumption. Remote attackers could exploit this vulnerability to cause a denial of service by using a specially crafted file...

Astra Linux – Vulnerability in Linux

A remote denial-of-service vulnerability was discovered in the Linux kernel’s TIPC kernel module. The while loop in tipclinkxmit encounters an unknown state while attempting to parse SKBs that are not present in the queue. Sending two small UDP packets to a system with a UDP interface causes the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum: Protect the driver from buggy firmware When processing port up/down events generated by the device’s firmware, the driver attempts to protect itself from events reported for non-existent local ports. However, it...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to allocate 100% of the CPU resources on the target system, depending on the type of CPU or through parallel execution of such a payload. This results in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm: slub: Fix the invocation of flushcpuslab and freeslab in the task context. The commit 5a836bf6b09f “mm: slub: Move the invocation of flushcpuslab and freeslab out of the IRQ context” fixes this issue by moving all invocations...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1

A flaw in memory leak prevention in the Linux kernel’s cpuentryarea mechanism for mapping X86 CPU data to memory was discovered. This flaw allows a local user to guess the locations of exception stacks or other important data. By exploiting this flaw, a local user can gain access to certain...