Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: clocking-wizard: Fixed an error in clkwzrdregisterdivider. A match was detected for a potential error of dereferencing the pointer in clkwzrdregisterdivider. If devmclkHWRegister fails, it sets “hw” to an error pointer, and...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Two use-after-free operations in ibmasminitone have been fixed. In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: Handling of inconsistent states in nilfsbtnodecreateblock. Syzbot reported that an inconsistency in the buffer state was detected in nilfsbtnodecreateblock, which triggered a kernel bug. It is not appropriate to consider...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ACPICA: Added the AMLNOOPERANDRESOLVE flag to the Timer instruction. ACPICA commit: 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no arguments are required to be passed for the ASL Time...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: tools/nolibc/stdlib: fixed a memory error in realloc Pass userplen to memcpy, instead of heap-len, to prevent realloc from copying an extra sizeofheap bytes beyond the allocated region...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9906: A potential memory leak was fixed in tw9906probe. In one of the error paths in tw9906probe, the memory allocated in v4l2ctrlhandlerinit and v4l2ctrlnewstd is not freed. This issue was addressed by calling...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Ensure that ptprate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clkptprate value after retrieving the default value from the device-tree may end up setting clkptprat...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: atmel: Fixed error handling in sndprotoprobe. The devicenode pointer is returned by ofparsephandle, with the refcount incremented. We should use ofnodeput on it after that operation. This function only calls ofnodeput in th...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: siox: fixed a possible memory leak in sioxdeviceadd. If deviceregister returns an error in sioxdeviceadd, the name allocated by devsetname needs to be freed. As noted in the comments for deviceregister, it should use putdevice to...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. In versions 1.6.36 through 1.6.55, there was an out-of-bounds read and write vulnerability in libpng’s ARM/AArch64 Neon-optimized palette expansion path. When...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a PAC URL was set, and the server hosting the PAC was unreachable, OCSP requests would be blocked, resulting in incorrect error pages being displayed. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm, slub: fixed a potential memory leak in kmemcacheopen. In the error path, the slub cache’s randomseq value might be leaked. This issue was addressed by using kmemcacherelease to release all relevant resources...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/rxe: Returns a CQE error if an invalid lkey is provided. In RXE, there is a lack of update of the WQE status in cases of LOCALwrite failures. This caused the following kernel panic if someone performed an atomic operation...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drbd: fixed the “LOGIC BUG” in drbdalbeginiononblock Although we ensure that we can perform lcgetcumulative while holding the device-allock spinlock, it may still fail if some other code path decides to use lctrylock at the wrong...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: Do not exceed the ARM processor CPER record buffer. There is a logic within GHES/CPER that detects whether the sectionlength is too small, but it does not detect whether it is too large. Currently, if the firmware...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Fixed the error code in iwlopmodedvmstart The error code should be preserved if iwlsetupdeferredwork fails. The current code returns ERRPTR0 which is NULL at this point. I believe that the missing error code could...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa: Fixed FFA device names for logical partitions. Each physical partition can provide multiple services, each with a unique UUID. Each such service can be represented as a logical partition with a unique combinatio...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: fec: handle pagepooldevallocpages error The fecenetupdatecbd function calls pagepooldevallocpages, but it does not handle the case where NULL is returned. A WARNON!newpage message is generated, but the program still proceeds...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: This issue prevents the possible dereferencing of error pointers. The qla4xxxgetepfwdb function is supposed to return NULL in case of an error. However, qla4xxxepconnect returns error pointers. Passing these error...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Media: MediTech; vcodec: Fix resource leaks in vdecmsgqueueinit. If any error occurs in vdecmsgqueueinit, we need to set “msgqueue-wdmaaddr.size = 0;”. Normally, this is done within the vdecmsgqueuedeinit function. However, if...