UBUNTU-CVE-2024-40902

In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size,...

UBUNTU-CVE-2024-40972

In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4xattrsetentry creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking which acquires locks on othe...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. debug is a small JavaScript debugging utility modeled after the core debugging technology of Node.js open sourced by Debug.js. A security vulnerability exists in the Linux kern...

CBL Mariner 2.0 Security Update: kernel (CVE-2020-27815)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-27815 advisory. - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the abili...

UBUNTU-CVE-2024-39276

In the Linux kernel, the following vulnerability has been resolved: ext4: fix mbcacheentry's erefcnt leak in ext4xattrblockcachefind Syzbot reports a warning as follows: ============================================ WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mbcachedestroy+0x224/0x290 Modules...

UBUNTU-CVE-2024-38599

In the Linux kernel, the following vulnerability has been resolved: jffs2: prevent xattr node from overflowing the eraseblock Add a check to make sure that the requested xattr node size is no larger than the eraseblock minus the cleanmarker. Unlike the usual inode nodes, the xattr nodes aren't...

SUSE CVE-2023-4458

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on...

PT-2024-13198 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A flaw was found in the parsing of extended attributes in the kernel ksmbd module, resulting from the lack of proper validation of user-supplied data. This can cause a read past the en...

Linux Kernel ksmbd smb2_open Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Furthermore, only systems with ksmbd enabled are vulnerable. The specific...

SUSE CVE-2021-47351

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix races between xattrset|get and listxattr operations UBIFS may occur some problems with concurrent xattrset|get and listxattr operations, such as assertion failure, memory corruption, stale xattr value1. Fix it by...

kernel: ext4: fix deadlock due to mbcache entry corruption

A deadlock vulnerability was found in the ext4 filesystem in the Linux kernel. When manipulating extended attribute xattr blocks, a race condition in non-atomic bitfield updates can cause the mbcache entry state to become corrupted. This leads to an infinite loop in ext4xattrblockset where the co...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a contention between the xattrset|get and listxattr operations...

kernel: ext4: init quota for 'old.inode' in 'ext4_rename'

In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4rename' Syzbot found the following issue: ext4parseparam: swantextraisize=128 ext4inodeinfoinit: swantextraisize=32 ext4rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828...

kernel: ext4: fix invalid free tracking in ext4_xattr_move_to_block()

A memory management flaw was found in the Linux kernel's ext4 filesystem extended attribute handling. In ext4xattrmovetoblock, when moving an extended attribute value to an external block, the code checks entry-evalueinum to determine if the buffer was allocated via kvmalloc. However, at cleanup...

SUSE CVE-2024-26689

In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encodecapmsg In fs/ceph/caps.c, in encodecapmsg, "use after free" error was caught by KASAN at this line - 'cephbuffergetarg-xattrbuf;'. This implies before the refcount could be increment here, it...

SUSE CVE-2023-52640

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix oob in ntfslistxattr The length of name cannot exceed the space occupied by ea...

UBUNTU-CVE-2023-52640

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix oob in ntfslistxattr The length of name cannot exceed the space occupied by ea...

OESA-2024-1283 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the...

Huawei EulerOS: Security Advisory for tar (EulerOS-SA-2024-1350)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP11 : tar (EulerOS-SA-2024-1231)

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an applicati...