CVE-2022-48937

A vulnerability was found in the Linux kernel’s iouring subsystem, specifically within the ioaddbuffers function. This issue could lead to soft lockups by repeatedly invoking kmalloc in a loop of around 65,535 iterations, especially when debugging features like KASAN are enabled. Symptoms include...

DEBIAN-CVE-2022-48937

In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...

CVE-2022-48937

In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...

UBUNTU-CVE-2022-48937

In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...

CVE-2022-48937 io_uring: add a schedule point in io_add_buffers()

In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...

SUSE CVE-2024-43873

In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacketallow There are two issues around seqpacketallow: 1. seqpacketallow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if...

DEBIAN-CVE-2024-43873

In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacketallow There are two issues around seqpacketallow: 1. seqpacketallow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if...

SUSE CVE-2024-43824

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

AZL-48514 CVE-2024-43824 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

DEBIAN-CVE-2024-43824

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

UBUNTU-CVE-2024-43824

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

SUSE CVE-2024-22121

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly use cached epcfeatures in the pciepftestcoreinit function...

CVE-2024-41909

A flaw was found in Apache MINA SSHD. This flaw allows an attacker who can intercept traffic between the client and server to drop certain packets from the stream. This potentially causes a Terrapin attack where the client and server consequently end up with a connection for which some security...

Security update for apptainer (important)

openSUSE Security Update: Security update for apptainer Announcement ID: openSUSE-SU-2024:0244-1 Rating: important References: 1221364 1224114 Cross-References: CVE-2023-30549 CVE-2023-38496 CVE-2024-3727 CVSS scores: CVE-2023-30549 NVD : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...

Magento Improper Authorization Leading to Security feature bypass

Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information...

GHSA-RF4Q-M23C-7Q8R Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability

Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited...

[SECURITY] Fedora 39 Update: python2.7-2.7.18-43.fc39

Python 2 is an old version of the language that is incompatible with the 3.x line of releases. The language is mostly the same, but many details, especial ly how built-in objects like dictionaries and strings work, have changed considerably, and a lot of deprecated features have finally been...

Microsoft SmartScreen 安全漏洞

Microsoft SmartScreen is a Microsoft-developed security technology designed to help users identify and block potential malware and phishing attacks. A security vulnerability exists in Microsoft SmartScreen. An attacker could exploit the vulnerability to bypass certain features. The following...

CVE-2024-41909 Apache MINA SSHD: integrity check bypass

Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with...