Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xHCI: Properly handling isoc Babble and Buffer Overrun events. xHCI 4.9 explicitly prohibits making assumptions that the xHC has released its ownership of a multi-TRB TD when an error occurs in one of the early TRBs. However,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: Validates user input to ensure it is of the expected length. I received multiple syzbot reports indicating that old bugs were exposed due to BPF after the commit 20f2505fb436 “bpf: Try to avoid kzalloc in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/xe/xepagefault: Writers to read-only Virtual Memory Addresses are now disallowed. The page fault handler should reject write/atomic accesses to read-only Virtual Memory Addresses. Add code to handle this in xepagefaultservice...

Astra Linux – Vulnerability in Linux 5.15

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in opensc

A flaw was discovered in OpenSC packages that could allow for a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length PIN is passed. This issue poses a security risk, especially for OS...

Astra Linux – Vulnerability in ldns

When a zone file in ldns 1.7.1 is parsed, the function ldnsnsec3saltdata is too trusted regarding the length value obtained from the zone file. During the memcpy operation, the data consisting of 0xfe – ldnsrdfsizesaltrdf bytes can be copied, leading to heap overflow information leakage...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.0.0 to 3.0.3, and 2.6.0 to 2.6.10, the Gryphon dissector could enter an infinite loop. This issue was addressed in the plugin file plugins/epan/gryphon/packet-gryphon.c by checking for a packet length of zero...

Astra Linux – Vulnerability in Tomcat9

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers by setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat would not reject requests containing an invalid Content-Length header. This...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fixed an issue where the data length of the skb structure was underflowed. A BUGON will be triggered in include/linux/skbuff.h, resulting in intermittent kernel panics when a length underflow is detected. This issu...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fixed the overflow bug in musbgadget.c The musbgadgetqueue function calls the USB function device. This function adds the passed request to musbep::reqlist. If request-length musbep-packetsz and isbuffermappedreq retur...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: clk: zynqmp: Fixed a stack-out-of-bounds issue in strncpy. “BUG: KASAN: Stack-out-of-bounds in strncpy+0x30/0x68” The Linux-ATF interface uses 16 bytes of SMC payload. If the clock name is longer than 15 bytes, the string...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext2/dax: Fixed ext2setsize when len is page-aligned. The PAGEALIGNx macro returns the next highest value that is a multiple of the page size. However, if x is already page-aligned, it simply returns x. Therefore, if x is passed ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rxrpc: A integer overflow has been fixed in rxgkverifyresponse. In rxgkverifyresponse, there is a potential integer overflow due to rounding the tokenlen value up before checking it. This allows the length check to be bypassed...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: tipc: Check the attribute length for the bearer name. syzbot reported uninit-value: ===================================================== BUG: KMSAN: uninit-value in stringnocheck lib/vsprintf.c:644 inline BUG: KMSAN:...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fixed an info leak in hidsubmitctrl. In hidsubmitctrl, the way of calculating the report length does not take into account that report-size can be zero. When running the syzkaller reproducer, a report of size 0 cause...

Astra Linux – Vulnerability in Poppler

The JPXStream::init function in Poppler 0.78.0 and earlier does not check for negative values of stream length, which can lead to an Integer Overflow. This allows an attacker to allocate a large memory chunk on the heap, with the size controlled by them. This issue was demonstrated by pdftocairo...

Astra Linux – Vulnerability in libpcap

The sf-pcapng.c file in libpcap before version 1.9.1 does not properly validate the PHB header length before allocating memory...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: hibmcge – fixed the issue of division by zero. When the network port is down, the queue is released, and ring-len becomes 0. In debugfs, the hbggetqueueusednum function will be called, which may lead to a division by zero...

Astra Linux - уязвимость в u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation with an unvalidated length at nfsreadlinkreply in the “else” block, after calculating the new path length...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw arises due to issues with the length validation of the handler for the XIChangeProperty request, leading to out-of-bounds memory reads and potential information disclosure. This issue can result in elevation of local privileges on system...