CVE-2022-48932 net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, Fix slab-out-of-bounds in mlx5cmddrcreatefte When adding a rule with 32 destinations, we hit the following out-of-band access issue: BUG: KASAN: slab-out-of-bounds in mlx5cmddrcreatefte+0x18ee/0x1e70 This patch fixe...

DEBIAN-CVE-2022-48913

In the Linux kernel, the following vulnerability has been resolved: blktrace: fix use after free for struct blktrace When tracing the whole disk, 'dropped' and 'msg' will be created under 'q-debugfsdir' and 'bt-dir' is NULL, thus blktracefree won't remove those files. What's worse, the following...

CVE-2022-48925

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...

CVE-2022-48925 RDMA/cma: Do not change route.addr.src_addr outside state checks

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...

CVE-2022-48919 cifs: fix double free race when mount fails in cifs_get_root()

In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifsgetroot When cifsgetroot fails during cifssmb3domount we call deactivatelockedsuper which eventually will call delayedfree which will free the context. In this situation we shoul...

CVE-2022-48919

In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifsgetroot When cifsgetroot fails during cifssmb3domount we call deactivatelockedsuper which eventually will call delayedfree which will free the context. In this situation we shoul...

CVE-2022-48913

The CVE-2022-48913 issue is a Linux kernel use-after-free in blk_trace (blktrace) allocated when tracing a full disk, where created files under q->debugfs_dir are not removed if bt->dir is NULL, allowing stale pointers (dropped, msg) to be dereferenced. The result is a KASAN-triggered use-a...

CVE-2022-48912 netfilter: fix use-after-free in __nf_register_net_hook()

In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in nfregisternethook We must not dereference @newhooks after nfhookmutex has been released, because other threads might have freed our allocated hooks already. BUG: KASAN: use-after-free in...

CVE-2022-48871

A vulnerability was found in the Linux kernel's qcomgeniserial.c driver. A lack of proper size validation can lead to an out-of-bounds write caused by a mismatch between the RX FIFO buffer size and the actual RX FIFO depth after initialization. This issue can lead to memory corruption or crashes...

CVE-2022-48871

In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO port-rxfifo based on default RX FIFO depth, e.g. 16. Later during serial startup the qcomgeniserialportsetup...

CVE-2023-52907 nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Wait for outurb's completion in pn533usbsendframe Fix a use-after-free that occurs in hcd when inurb sent from pn533usbsendframe is completed earlier than outurb. Its callback frees the skb data in...

CVE-2022-48871

In CVE-2022-48871, the Linux kernel fix targets tty: serial: qcom-geni-serial slab-out-of-bounds on the RX FIFO buffer. The probe allocates port->rx_fifo using a default depth (e.g., 16); during serial startup, port->rx_fifo_depth is updated to match device capabilities (e.g., 32). The RX U...

CVE-2022-48871 tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO port-rxfifo based on default RX FIFO depth, e.g. 16. Later during serial startup the qcomgeniserialportsetup...

CVE-2022-48871

In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO port-rxfifo based on default RX FIFO depth, e.g. 16. Later during serial startup the qcomgeniserialportsetup...

CVE-2022-48871 tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO port-rxfifo based on default RX FIFO depth, e.g. 16. Later during serial startup the qcomgeniserialportsetup...

CVE-2022-48869

CVE-2022-48869 concerns the Linux kernel gadgetfs USB driver. The issue arises from a race between gadgetfs_fill_super() (mount path) and gadgetfs_kill_sb() (unmount path), where the_device could be deallocated while gadgetfs_fill_super() still uses it, resulting in a use-after-free. The provided...

CVE-2022-48869 USB: gadgetfs: Fix race between mounting and unmounting

In the Linux kernel, the following vulnerability has been resolved: USB: gadgetfs: Fix race between mounting and unmounting The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesyste...

CVE-2024-43878

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...

UBUNTU-CVE-2024-43878

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...

CVE-2024-43878

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...