Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then perform the ptrace access check on that task, and finally look up the task from the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to select a next hop when an MPLS route has multiple next hops. While traversing the MPLS label stack, the hash routine caches hdr for the current...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. This creates the conditions for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues as well On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they do not support draw commands. Unlike GFX7 and newer versions, which hav...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers using freeirq when requestirq fails. In the rollback loop, it uses the failing index i instead of the already...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc’d buffer pointer through a struct kfifo, but pass a literal ‘4’ as the byte count to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The “already exists” dedup logic in nfconncountadd determines whether a connection has already been counted and can be skipped instead of incrementing the connlimit count...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sgp30: Handle IAQ thread creation failure kthreadrun may fail and return an error pointer; however, sgpprobe stores this error and returns success, resulting in the device being registered without its IAQ thread...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift. A shiftbits value of 32 or more triggers...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: policyint ensures that list heads are initialized prior to the fail path. If profile creation fails before policyinit is completed, the list heads are not properly initialized, causing profilefree sanity checks to trigg...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g., a dummy device where maxmtu == 0 and accepts MTU 2147483634 causes pschedmtu to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfers in a DMAPOOLSIZE 256-byte bounce buffer obtained via dmapoolalloc, which does not zero out the allocation. They...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error occurs while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Since the count is incremented before each frag mapping, it always matches the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after calling dmachanput. However, dmachanput calls dmadeviceput, which may release the last reference to the device if the DMA provider ha...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...