kernel: use-after-free in read in vt_do_kdgkb_ioctl

A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality...

kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg

A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the btsockrecvmsg and btsockioctl functions could lead to a use-after-free on a socket buffer "skb". This flaw allows a local user to cause a denial of service condition or potential code execution...

kernel: ethtool: Fix uninitialized number of lanes

In the Linux kernel, the following vulnerability has been resolved: ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes when setting link modes using the legacy IOCTL ethtool interface. Since 'struct ethtoollinkksettings' is not initialized in this path, drive...

kernel: USB: usbtmc: Fix direction for 0-length ioctl control messages

A flaw was found in the Linux kernel’s USB Test and Measurement Class usbtmc driver. The driver did not properly validate the direction bit when handling ioctl calls for control messages with a length of zero. Under these circumstances, an incorrect direction can be submitted, leading to mismatch...

ASUS GPUTweak II 安全漏洞

ASUS GPUTweak II is a driver from Asus China Inc. It is used to drive more FPS. A security vulnerability exists in ASUS GPUTweak II version v1.4.5.2, which stems from a security flaw in the component IOMap64.sys. The vulnerability can be exploited by an attacker to elevate privileges and execute...

ASUS USB 安全漏洞

ASUS USB is a wireless adapter from Asus China. A security vulnerability exists in ASUS USB 3.0 Boost Storage Driver version 5.30.20.0, which originates from a problem with the component AsUpIO64.sys and allows attackers to elevate privileges and execute arbitrary code by sending a crafted IOCTL...

ASUS ATSZIO Driver 安全漏洞

ASUS ATSZIO Driver is a driver from Asus China. A security vulnerability exists in ASUS ATSZIO Driver version v0.2.1.7, which originates from a security flaw in the component ATSZIO 64.sys. The vulnerability can be exploited by an attacker to elevate privileges and execute arbitrary code by sendi...

Insyde Software Corp SEG Windows Driver 安全漏洞

Insyde Software Corp SEG Windows Driver is a driver for managing and processing system events from Insyde Software Corp China. A security vulnerability exists in Insyde Software Corp SEG Windows Driver version v100.00.07.02, which originates from a security flaw in the component segwindrvx64.sys...

CVE-2023-52705

CVE-2023-52705 is a kernel vulnerability affecting the nilfs2 filesystem code in Linux. The issue is an underflow/incorrect boundary calculation in NILFS_SB2_OFFSET_BYTES that computes the position of the second superblock, which can underflow when the device size is smaller than 4096 bytes. This...

CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

DEBIAN-CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47375

In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blktrace access after removing by sysfs There is an use-after-free problem triggered by following process: P1sda P2sdb echo 0 /sys/block/sdb/trace/enable blktraceremovequeue synchronizercu blktracefree...

UBUNTU-CVE-2021-47265

In the Linux kernel, the following vulnerability has been resolved: RDMA: Verify port when creating flow rule Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5ib driver could cause to the below oops. Call trace:...

UBUNTU-CVE-2021-47364

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix memory leak in compatinsnlist compatinsnlist handles the 32-bit version of the COMEDIINSNLIST ioctl whenwhen CONFIGCOMPAT is enabled. It allocates memory to temporarily hold an array of struct comediinsn converted fro...

UBUNTU-CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47383

In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUTVSCREENINFO passing the fbvarscreeninfo struct containing only the fields xres, yres, and bitsperpixel with values...

CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47383 tty: Fix out-of-bound vmalloc access in imageblit

In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUTVSCREENINFO passing the fbvarscreeninfo struct containing only the fields xres, yres, and bitsperpixel with values...

CVE-2021-47383

In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUTVSCREENINFO passing the fbvarscreeninfo struct containing only the fields xres, yres, and bitsperpixel with values...