CVE-2024-42304

In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this...

CVE-2024-42304

CVE-2024-42304 (Linux kernel ext4) : The vulnerability arises when the first directory block is a hole in non-inline directories, causing ext4_read_dirblock to mis-handle a hole read and potentially crash code that relies on "." and "..". The fix prevents loading corrupted data by reporting files...

CVE-2024-42305: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dxroot before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D...

PT-2024-33719

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue arises when Ext4 throws a -EBADMSG error through ext4 readdir due to a checksum error, resulting in a WARNING. This occurs because nfsd does not map EBADMSG to nfserr io. The error ...

CVE-2024-43828: Loop with Unreachable Exit Condition

In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fastcommit When doing fastcommit replay an infinite loop may occur due to an uninitialized extentstatus struct. ext4extdetermineinserthole does not detect the replay and calls...

CVE-2024-42304: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this...

CLSA-2024-1723807956 Fix of 55 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-39467 - f2fs: fix to do sanity check on ixattrnid in sanitycheckinode CVE-url: https://ubuntu.com/security/CVE-2024-36940 - pinctrl: core: delete incorrect free in pinctrlenable CVE-url: https://ubuntu.com/security/CVE-2024-38659 - enic: Validate leng...

CLSA-2024-1723806933 Fix of 55 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-39467 - f2fs: fix to do sanity check on ixattrnid in sanitycheckinode CVE-url: https://ubuntu.com/security/CVE-2024-36940 - pinctrl: core: delete incorrect free in pinctrlenable CVE-url: https://ubuntu.com/security/CVE-2024-38659 - enic: Validate leng...

USN-6951-2 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - User-Mode Linux UML; - x86 architecture; - Accessibility subsystem; -...

SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2024:2896-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2896-1 advisory. The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were...

Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6951-2)

"The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6951-2 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws i...

CLSA-2024-1723567849 kernel: Fix of 20 CVEs

net: fix dstnegativeadvice race CVE-2024-36971 - spec: update shim Conflicts, Provides keys - ipv6: fib6rules: avoid possible NULL dereference in fib6ruleaction CVE-2024-36902 - ipv6: prevent NULL dereference in ip6output CVE-2024-36901 - drm/amd/display: Atom Integrated System Info v22 for DCN35...

SUSE-SU-2024:2896-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-41014: xfs: add bounds checking to xlogrecoverprocessdata bsc1228408. - CVE-2024-41013: xfs: do not walk off the end of a directory data block...

kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()

A vulnerability was found in the ext4mbtrybestfound function in the Linux kernel. This issue could lead to memory corruption or crashes due to the allocation of blocks from a group with a corrupted block bitmap...

kernel: ext4: fix double-free of blocks due to wrong extents moved_len

A vulnerability was found in the Linux kernel. This issue occurs in the ext4 function, in ext4moveextents, where an error in updating the movedlen variable can lead to double-free of blocks and corrupt block accounting. This could lead to crashes or undefined behavior...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2024-12581)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12581 advisory. - net/mlx5e: drop shorter ethernet frames Manjunath Patil Orabug: 36879157 CVE-2024-41090 CVE-2024-41091 - netfilter: ipset: Fix race between...

Unbreakable Enterprise kernel security update

5.4.17-2136.334.6 - loop: Fix a race between loop detach and loop open Gulam Mohamed Orabug: 36197800 - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs Alexandre Chartre Orabug: 36672495 - x86/bhi: Avoid warning in DB handler due to BHI mitigation Alexandre Chartre Orabug...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.334.6.el7 - loop: Fix a race between loop detach and loop open Gulam Mohamed Orabug: 36197800 - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs Alexandre Chartre Orabug: 36672495 - x86/bhi: Avoid warning in DB handler due to BHI mitigation Alexandre Chartre...

CVE-2024-42257

In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostrpad for svolumename As with the other strings in struct ext4superblock, svolumename is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 "ext4: add nonstring annotations to ext4.h". Using...

SUSE CVE-2024-42257

In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostrpad for svolumename As with the other strings in struct ext4superblock, svolumename is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 "ext4: add nonstring annotations to ext4.h". Using...