CVE-2021-47553

In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringupcpu To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the...

CVE-2021-47553 sched/scs: Reset task stack state in bringup_cpu()

In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringupcpu To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the...

CVE-2021-47553 sched/scs: Reset task stack state in bringup_cpu()

In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringupcpu To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in use, poisoned shadow is left around for each of the...

CVE-2021-47553

The CVE describes a Linux kernel issue (CVE-2021-47553) in the SCS and KASAN shadow stack handling for the idle task during CPU hotplug (bringup_cpu). When a CPU is offline and brought back online, stale KASAN shadow and stale shadow call stack (SCS) state could lead to bogus warnings or leak por...

CVE-2021-47535 drm/msm/a6xx: Allocate enough space for GMU registers

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate enough space for GMU registers In commit 142639a52a01 "drm/msm/a6xx: fix crashstate capture for A650" we changed a6xxgetgmuregisters to read 3 sets of registers. Unfortunately, we didn't change the memory...

CVE-2021-47535

CVE-2021-47535 concerns the Linux kernel DRM MSM A6XX driver. The issue arises in a6xx_get_gmu_registers() where three sets of GMU registers are read but the allocation for the array wasn’t updated, triggering a KASAN slab-out-of-bounds write (Write of size 8) in _a6xx_get_gmu_registers. Public n...

CVE-2021-47259

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4initclient KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server. Olga was able to hit this with kernels starting...

CVE-2021-47291

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix another slab-out-of-bounds in fib6nhflushexceptions While running the self-tests on a KASAN enabled kernel, I observed a slab-out-of-bounds splat very similar to the one reported in commit 821bbf79fe46 "ipv6: Fix KASAN:...

CVE-2023-52794

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: powerclamp: fix mismatch in get function for maxidle KASAN reported this 444.853098 BUG: KASAN: global-out-of-bounds in paramgetint+0x77/0x90 444.853111 Read of size 4 at addr ffffffffc16c9220 by task cat/2105...

CVE-2021-47461

A possible race condition flaw was found in the Linux kernel. When a process exits, its virtual memory areas VMAs are removed by exitmmap, and at the same time, userfaultfdwriteprotect is called...

CVE-2024-36012

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msftdoclose Tying the msft-data lifetime to hdev by freeing it in hcireleasedev to fix the following case: use msftdoclose msft = hdev-msftdata; if !msft ...1 filterlock; ...4 msftdata;...

CVE-2024-36013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect Extend a critical section to prevent chan from early freeing. Also make the l2capconnect return type void. Nothing is using the returned value but it is ugly to return a...

CVE-2024-36012

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msftdoclose Tying the msft-data lifetime to hdev by freeing it in hcireleasedev to fix the following case: use msftdoclose msft = hdev-msftdata; if !msft ...1 filterlock; ...4 msftdata;...

CVE-2024-36013 Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect Extend a critical section to prevent chan from early freeing. Also make the l2capconnect return type void. Nothing is using the returned value but it is ugly to return a...

CVE-2024-36013 Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect Extend a critical section to prevent chan from early freeing. Also make the l2capconnect return type void. Nothing is using the returned value but it is ugly to return a...

CVE-2024-36013 Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2capconnect Extend a critical section to prevent chan from early freeing. Also make the l2capconnect return type void. Nothing is using the returned value but it is ugly to return a...

CVE-2024-36012 Bluetooth: msft: fix slab-use-after-free in msft_do_close()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msftdoclose Tying the msft-data lifetime to hdev by freeing it in hcireleasedev to fix the following case: use msftdoclose msft = hdev-msftdata; if !msft ...1 filterlock; ...4 msftdata;...

CVE-2024-36012 Bluetooth: msft: fix slab-use-after-free in msft_do_close()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msftdoclose Tying the msft-data lifetime to hdev by freeing it in hcireleasedev to fix the following case: use msftdoclose msft = hdev-msftdata; if !msft ...1 filterlock; ...4 msftdata;...

SUSE CVE-2021-47346

In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etf: Fix global-out-of-bounds in tmcupdateetfbuffer commit 6f755e85c332 "coresight: Add helper for inserting synchronization packets" removed trailing '\0' from barrierpkt array and updated the call sites like...

SUSE CVE-2023-52770

In the Linux kernel, the following vulnerability has been resolved: f2fs: split initial and dynamic conditions for extentcache Let's allocate the extentcache tree without dynamic conditions to avoid a missing condition causing a panic as below. create a file w/ a compressed flag disable the...