UBUNTU-CVE-2024-53143

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput and watchedobjects decrement Ensure the superblock is kept alive until we're done with iput. Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotif...

CVE-2024-53101

In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in fromkuid and fromkgid ocfs2setattr uses attr-iamode, attr-iauid and attr-iagid in a trace point even though ATTRMODE, ATTRUID and ATTRGID aren't set. Initialize all fields of newattrs to avoid...

CVE-2024-53107

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: prevent integer overflow in pagemapscangetargs The "arg-veclen" variable is a u64 that comes from the user at the start of the function. The "arg-veclen sizeofstruct pageregion" multiplication can lead to integer...

CVE-2024-53112 ocfs2: uncache inode which has failed entering the group

In the Linux kernel, the following vulnerability has been resolved: ocfs2: uncache inode which has failed entering the group Syzbot has reported the following BUG: kernel BUG at fs/ocfs2/uptodate.c:509! ... Call Trace: ? diebody+0x5f/0xb0 ? die+0x9e/0xc0 ? dotrap+0x15a/0x3a0 ?...

CVE-2024-53107

CVE-2024-53107 affects the Linux kernel in fs/proc/task_mmu.c (pagemap_scan_get_args). The issue is an integer overflow: arg->vec_len is read as a u64 from user space and used in the expression arg->vec_len * sizeof(struct page_region), which can wrap. The fix uses size_mul() to perform the...

CVE-2024-53107

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: prevent integer overflow in pagemapscangetargs The "arg-veclen" variable is a u64 that comes from the user at the start of the function. The "arg-veclen sizeofstruct pageregion" multiplication can lead to integer...

CVE-2024-53107: Integer Overflow or Wraparound

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: prevent integer overflow in pagemapscangetargs The "arg-veclen" variable is a u64 that comes from the user at the start of the function. The "arg-veclen sizeofstruct pageregion" multiplication can lead to integer...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the active flag for FTEs in the net/mlx5 component not being checked by locking during deletion, causing the...

ROS-20241129-01

A vulnerability in the ks8851 component of the Linux operating system kernel is related to improper locking in the ks8851dbgdumpkkt, ks8851rxpkts, and ks8851irq functions in the drivers/net/ethernet/micrel/ks8851common.c. Exploitation of the vulnerability could allow an attacker to cause a denial...

PT-2024-41818

Уязвимость функции free cached dir модуля fs/smb/client/cached dir.c поддержки клиента SMB ядра операционной системы Linux связана с неправильным контролем идентификаторов ресурсов «внедрение ресурсов». Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2024-53101

In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in fromkuid and fromkgid ocfs2setattr uses attr-iamode, attr-iauid and attr-iagid in a trace point even though ATTRMODE, ATTRUID and ATTRGID aren't set. Initialize all fields of newattrs to avoid...

CVE-2024-53101 fs: Fix uninitialized value issue in from_kuid and from_kgid

In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in fromkuid and fromkgid ocfs2setattr uses attr-iamode, attr-iauid and attr-iagid in a trace point even though ATTRMODE, ATTRUID and ATTRGID aren't set. Initialize all fields of newattrs to avoid...

CVE-2024-53101: Use of Uninitialized Resource

In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in fromkuid and fromkgid ocfs2setattr uses attr-iamode, attr-iauid and attr-iagid in a trace point even though ATTRMODE, ATTRUID and ATTRGID aren't set. Initialize all fields of newattrs to avoid...

Astra Linux - уязвимость в nodejs

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory...

PT-2024-41789

Уязвимость функции ceph mds check access модуля fs/ceph/mds client.c поддержки распределенной файловой системы Ceph ядра операционной системы Linux связана с ошибками при обновлении счетчика ссылок. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемо...

ROS-20241119-01

A vulnerability in the ath11k component of the SUNRPC kernel of the Linux system is related to use-after-use errors release in the rpcclntremovepipedir and rpcsetuppipedir functions in net/sunrpc/clnt.c. Exploitation of the vulnerability could allow an attacker to escalate privileges on the syste...

GHSA-G85V-WF27-67XC Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`

Summary Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of...

PT-2024-41639

Уязвимость функции ls recover модуля fs/dlm/recoverd.c поддержки распределенного менеджера блокировок ядра операционной системы Linux связана с ошибками возвращаемых значений. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

The vulnerability of the fs.statfs function in the Node.js software platform allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the fs.statfs function in the Node.js software platform is related to the improper assignment of permissions for the critical resource. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the...

PT-2024-35571

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns an integer overflow in the pagemap scan get args function within the Linux kernel's fs/proc/task mmu component. The arg-vec len variable, a u64 value provided by the...