kernel: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error The initial settings will be written before the codec probe function. But, the rt711-component doesn't be assigned yet. If IO error happened during initial...

kernel: blk-iolatency: Fix inflight count imbalances and IO hangs on offline

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for th...

kernel: igc: Reinstate IGC_REMOVED logic and implement it properly

In the Linux kernel, the following vulnerability has been resolved: igc: Reinstate IGCREMOVED logic and implement it properly The initially merged version of the igc driver code via commit 146740f9abc4, "igc: Add support for PF" contained the following IGCREMOVED checks in the igcrd32/wr32 MMIO...

kernel: race condition in snd_pcm_hw_free leading to use-after-free

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hwparams. The hwfree ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges ...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

Oracle Linux 8 : container-tools:3.0 (ELSA-2022-7529)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7529 advisory. - fixes CVE-2021-3602 - amend CVE-2022-1708 - fix CVE-2022-1708 - thanks to Peter Hunt - fix CVE-2022-27650 - fixes CVE-2021-3602 - rc95 fixes...

PT-2022-27492 · Jenkins · Jenkins Loader.Io Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins loader.io Plugin versions 1.0.1 and earlier Description: A missing permission check in the Jenkins loader.io Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can ...

GSD-2022-1006707 io-wq: Fix memory leak in worker creation

io-wq: Fix memory leak in worker creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.4 by commit...

PT-2022-34963

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.3 Description The issue is related to the calculation of sqe offsets in io uring. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v6.0.3...

PT-2022-34934 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.6 Description: The issue is related to a NULL pointer dereference in the io msg send fd function. This problem was introduced in version v6.0 and is fixed in version v6.0.6. The actual impact and attack...

PT-2022-35175 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the io uring/af unix component, where the garbage collection of registered files is deferred to the io uring release. This is an automated identification of a potentia...

PT-2022-35405 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to io uring/af unix, where registered files gc is deferred to io uring release. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

CVE-2021-34567

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read...

WAGO 缓冲区错误漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is specifically designed for use in industrial environments as an electronic system for the operation of digital algorithms. A buffer error vulnerability exists in the WAGO I/O-Check Service, which originates fr...

PT-2022-10354 · Wago · Wago I/O-Check Service

Name of the Vulnerable Software and Affected Versions: WAGO I/O-Check Service affected versions not specified Description: The issue allows an unauthenticated remote attacker to send a specially crafted packet containing OS commands, which can cause a denial of service and a limited out-of-bounds...

PT-2022-10353 · Wago · Wago I/O-Check Service

Name of the Vulnerable Software and Affected Versions: WAGO I/O-Check Service affected versions not specified Description: The issue allows an unauthenticated remote attacker to send a specially crafted packet containing OS commands, which can cause the iocheck process to crash and result in memo...

RHEL 8 : grafana-pcp (RHSA-2022:7648)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7648 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

Moderate: Red Hat Security Advisory: container-tools:3.0 security update

An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...