Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts the return value from decompresslznt: uncsize = decompresslzntframeondis...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored within it. This number is an u16 value; it is then multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. As a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Propagate partial completion length across ERP recovery dasddefaulterppostaction copies the timing and device state from the finished ERP request back to the original request but drops procbytes. A request that was...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fecptpinit is only called when fep-bufdescex is available. However, fecprobe unconditionally calls fecptpstop on the failedinit path, and fecdrvremove unconditionally calls fecptpstop...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is an u16 type, while ha-maxreqqueues, ha-maxrspqueues, and ha-maxqpairs are u8 types. Deriving the queue count as “ha-maxreqqueues = ha-msixcount -...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: Drop ESP-in-TCP packets without an ingress device ESP-in-TCP receives records via the TCP strparser. handleesp retrieves skb-dev from the stored skbiif prior to passing the packet to the XFRM input path. Queued TCP data can...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock An issue has been fixed wherein userspace or the guest can program a Hyper-V synthetic timer with a past deadline via integer overflow, preventing the CPU from making...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: missing guard for CRUSH type name lookup Localized read selection can traverse a parent bucket whose name exists in the CRUSH map but for which no matching entry is found in typenames. getimmediateparent then dereference...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloccarminefb The memory allocated for modelist in fbvideomodetomodelist is not freed in the subsequent error path. Fix that by calling fbdestroymodelist...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e “netfilter: nftconnlimit: update the count if add was skipped” introduced a regression wherein packets for valid connections are dropped...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one Release the UAR index returned by the hardware...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count, and the ring bound;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939sessionfreshnew: initialize receive buffer Set the allocated buffer in j1939sessionfreshnew to zero so that it contains no residual data. Although there is a potential performance impact if users...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: fix memory leak in cedrusinitctrls In cedrusinitctrls, the V4L2 control handler is initialized before allocating memory for ctx-ctrls. If this allocation fails, the function returns -ENOMEM without freeing the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGE-entry ends in a pagelcns array whose length is determined by the on-disk lcnfollow field. checkrstbl validates the table’s bookkeeping mechanism; however, it never...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. As a result, a timed-out DMA transfer is unmapped and reported as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrangetimer on remove uclogicremove cancels the pen in-range timer and then stops the device: timerdeletesync&drvdata-inrangetimer; hidhwstophdev; timerdeletesync only guarantees that the time...