PT-2021-29658

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.13.4 Description The issue is related to a KASAN slab-out-of-bounds bug in the xdr set page base function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-25663

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.13.4 Description: The issue is related to a KASAN slab-out-of-bounds bug in the xdr set page base function. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5....

UVI-2021-1000801 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.10 by commit...

UVI-2021-1000769 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.43 by commit...

GSD-2021-1000747 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.125 by commit...

UVI-2021-1000747 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.125 by commit...

Unbreakable Enterprise kernel security update

5.4.17-2102.202.5 - sctp: delay autoasconf init until binding the first addr Xin Long Orabug: 32907967 CVE-2021-23133 CVE-2021-23133 - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860491 CVE-2021-31916 - uek-rpm: update kABI lists for the new symbols Saeed...

PT-2024-11345

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a global-out-of-bounds bug in the tmc update etf buffer function. This bug occurs because the barrier pkt array is accessed past its size, resulting in a KASAN...

GSD-2021-1000013 kasan: remove redundant config option

kasan: remove redundant config option This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.16 by commit 86463b30e4ef70c4551a94cb68b5a667c2e0084...

PT-2021-28482

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.11.7 through v5.11.15 Description: The issue is related to a redundant config option in the kasan feature. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2021-24488

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.11.7 through v5.11.15 Description: The issue is related to a redundant config option in the kasan feature. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2024-11105

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the xprtrdma component in the Linux kernel. After a reconnect, the reply handler opens the cwnd, enabling more RPC Calls to be sent before rpcrdma post recvs can...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.500.10.el7 - xen-blkback: fix error handling in xenblkbkmap Jan Beulich Orabug: 32492110 CVE-2021-26930 - xen-scsiback: don't 'handle' error by BUG Jan Beulich Orabug: 32492102 CVE-2021-26931 - xen-netback: don't 'handle' error by BUG Jan Beulich Orabug: 32492102 CVE-2021-26931 -...

kernel: bpf: Fix KASAN use-after-free Read in compute_effective_progs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KASAN use-after-free Read in computeeffectiveprogs Syzbot found a Use After Free bug in computeeffectiveprogs. The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling...

ASB-A-161151868

In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-150693748

In lockswakeupblocks of locks.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Linux 5.6 IORING_OP_MADVISE Race Condition

Linux 5.6 has an issue with IORINGOPMADVISE racing with coredumping. Linux 5.6: IORINGOPMADVISE races with coredumping Last year, I noticed that core dumping iterates over current-mm's VMA list without proper locking, under the assumption that the VMA list can not be modified externally. This...

Linux 5.6 IORING_OP_MADVISE Race Condition

Linux 5.6: IORINGOPMADVISE races with coredumping Last year, I noticed that core dumping iterates over current-mm's VMA list without proper locking, under the assumption that the VMA list can not be modified externally. This assumption was broken by userfaultfd, which can trigger VMA merging...

Linux - Use-After-Free Reads in show_numa_stats()

/ On NUMA systems, the Linux fair scheduler tracks information related to NUMA faults in taskstruct::numafaults and taskstruct::numagroup. Both of these have broken object lifetimes. Since commit 82727018b0d3 "sched/numa: Call tasknumafree from doexecve", first in v3.13, -numafaults is freed not...

Linux - Use-After-Free via race Between modify_ldt() and #BR Exception Exploit

/ When a BR exception is raised because of an MPX bounds violation, Linux parses the faulting instruction and computes the linear address of its memory operand. If the userspace instruction is in 32-bit code, this involves looking up the correct segment descriptor and adding the segment offset to...