kernel: tls: race between tx work scheduling and socket close

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler calls complete, which could lead to undefined behavior and a denial of service...

CBL Mariner 2.0 Security Update: hyperv-daemons / kernel (CVE-2024-26583)

The version of hyperv-daemons / kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26583 advisory. - In the Linux kernel, the following vulnerability has been resolved: tls: fix race between...

kernel: tls: race between async notify and socket close

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete; any code past that point risks touching already freed data. This could lead to a use-after-free issue an...

kernel: tls: race between tx work scheduling and socket close

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler calls complete, which could lead to undefined behavior and a denial of service...

PT-2024-6398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a race condition between fcntl setlk and close in the Linux kernel, which can lead to use-after-free reads when userspace reads /proc/locks. This can potentially...

CVE-2024-39119: Cross-Site Request Forgery (CSRF)

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via admin/infodeal.php?mudi=rev&nohrefStr=close...

PT-2024-8231

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.50 Description: The issue is related to a use after free vulnerability in the vdec close function in the Linux kernel's Qualcomm Venus V4L2 driver. This vulnerability can be exploited when the decoder device...

envoy:h2_capture_direct_response_persistent_fuzz_test: Heap-use-after-free in Envoy::Http::ConnectionManagerImpl::resetAllStreams

Detailed Report: https://oss-fuzz.com/testcase?key=5145983787794432 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: h2capturedirectresponsepersistentfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x51500009d2c8 Crash State:...

ffmpeg:ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer: Heap-use-after-free in ff_refstruct_unref

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4862663390199808 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDMPEG2VIDEOfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash...

Important: kernel

Issue Overview: An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x8664 lacks consistency checks for CR0 and CR4. CVE-2023-30456 In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix invalid address access in lookuprec when...

Mozilla: IndexedDB files retained in private browsing mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox...

Vulnerability of the close_altfile() function (filename.c) for UNIX-like system text terminals: allowing attackers to execute arbitrary commands

The vulnerability of the closealtfile function filename.c for UNIX-like system text terminals is related to the omission of the Shellquote call for LESSCLOSE. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

CVE-2024-36667: Cross-Site Request Forgery (CSRF)

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/idcProTypedeal.php?mudi=add&nohrefStr=close...

SUSE CVE-2021-3659

A NULL pointer dereference flaw was found in the Linux kernel's IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability...

CVE-2024-36549: Cross-Site Request Forgery (CSRF)

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/vpsCompanydeal.php?mudi=rev&nohrefStr=close...

SUSE CVE-2024-36881

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIOUNREGISTER ioctl, not a...

DEBIAN-CVE-2024-36881

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIOUNREGISTER ioctl, not a...

CVE-2024-36881

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIOUNREGISTER ioctl, not a...

UBUNTU-CVE-2024-36881

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIOUNREGISTER ioctl, not a...

CVE-2024-36881 mm/userfaultfd: reset ptes when close() for wr-protected ones

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIOUNREGISTER ioctl, not a...