Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: Do not break the lifecycle of vmdev. vmdev has a separate lifecycle because it has a struct device embedded within it. Therefore, having a release callback for it is correct. However, allocating the vmdev structure...

Astra Linux – Vulnerability in Firefox

Crossbeam-deque is a set of work-stealing deques for building task schedulers in Rust programming. In versions prior to 0.7.4 and 0.8.0, the race condition resulted in one or more tasks in the worker queue being popped twice, instead of other tasks that were forgotten and never popped. If tasks a...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ubi: Fixed the UAF Use-After-Free issue in the wear-leveling entry of eraseblkcountseqshow. The wear-leveling entry could be freed during an error-prone path, and this entry might be accessed again in eraseblkcountseqshow, for...

Astra Linux – Vulnerability in Chromium

The use of after-free in V8 in Google Chrome before version 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Deferring the release of the inner map when necessary When updating or deleting an inner map in the map array or map htab, the map may still be accessed by non-sleepable programs or sleepable programs. However, when the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: Fixed an inverted element activity check in nftmapcatchallactivate. nftmapcatchallactivate includes an inverted element activity check compared to its non-catchall counterpart, nftmapelemactivate, and...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid using the nfcthelperhash after the free operation. If the nfconntrackinitstart function fails e.g., due to a registernfconntrackbpf failure, the nfconntrackhelperfini cleanup routine frees the...

Astra Linux – Vulnerability in libarchive

A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, allowin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bonding: alb: Fixed a UAF in rlbarprecv during bond up/down The ALB RX path may access rxhashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlbdeinitialize frees rxhashtbl while RX handlers are still...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Speech Recognition in Google Chrome prior to version 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921 – fixed a crash that occurred during startup failure. If the network interface card fails to start, it is possible that the resetwork task has already been scheduled. Ensure that this task is canceled so that a...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: dm rq: Fixed a double-free of blkmqtagset in the dev remove operation after the table load fails. When loading a device-mapper table for a request-based mapped device, and the allocation/initialization of the blkmqtagset for the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel before version 5.15.3, fs/quota/quotatree.c does not validate the block number in the quota tree on disk. This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - dm integrity: Fixed a UAF Use-after-Free in dmintegritydtr. - dmintegrity also has the same UAF problem when dmresume and dmdestroy are executed concurrently. Therefore, the timer is canceled again in dmintegritydtr...

Astra Linux – Vulnerability in Nasm

In Netwide Assembler NASM 2.15rc10, there is a memory corruption issue related to heap use-after-free in the saawbytes function in nasmlib/saa.c...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Accessibility in Google Chrome before version 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fixed a possible use-after-free during activity updates. The “rule activity update” process periodically traverses a list of configured rules and queries their activity from the device. As part of this...

Astra Linux – Vulnerability in Chromium

The use of after-free in Serviceworker in Google Chrome on desktops before version 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The use of after-free in Dawn, prior to version 126.0.6478.114, allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in WebMIDI within Google Chrome before version 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...