Astra Linux - Vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decapandvalidate removes the outer SRv6 headers and sets the inner packet as the SKB network header. The IPv6 control block still contains values collected while parsing the outer packet...

Astra Linux – Vulnerability in Systemd

In udev under systemd, before version 260, local root execution could occur through malicious hardware devices and unsanitized kernel output...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A flaw was discovered in the Netfilter subsystem of the Linux kernel. The sctpmtcheck function did not validate the flagcount field properly. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, resulting in a system crash or the disclosure of sensitive...

Astra Linux – vulnerability in jetty9

In Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0.alpha1 through 10.0.0.beta2, and 11.0.0.alpha1 through 11.0.0.beta2O, on Unix-like systems, the system’s temporary directory is shared among all users on that system. A collocated user can observe the process of creating a temporary...

Astra Linux - vulnerability in linux

A flaw was found in how RTAS handles memory access from userspace to kernel communication. On a locked-down guest system running on top of PowerVM or KVM hypervisors pseries platform, a local user with root privileges could exploit this flaw to elevate their privileges to those of a running kerne...

Astra Linux – vulnerability in sqlite3

A flaw was found in SQLite’s SELECT query functionality src/select.c. This flaw allows an attacker capable of executing SQL queries locally on the SQLite database to cause a denial of service or potential code execution by triggering a use-after-free. The primary threat posed by this vulnerabilit...

Astra Linux – vulnerability in intel-microcode

Improper access control on certain third-generation IntelR XeonR Scalable Processors prior to BIOS version MR7 may allow a local attacker to potentially enable information disclosure via local access...

Astra Linux – vulnerability in linux-5.10

This vulnerability enables local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. To exploit this vulnerability, an attacker must first gain the ability to execute low-privilege code on the target system. The specific flaw lies in how eBPF programs are handled...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the handling of offloads in ipgre.c, there is a possibility of a page fault due to an invalid memory access. This could lead to the disclosure of local information without the need for additional execution privileges. User interaction is not required for exploitation. Product: Android Versions...

Astra Linux – Vulnerability in Linux, Linux 5.10

In socksocknested of sock.c, there is a potential exploit after the free function due to a race condition. This could lead to a local escalation of privileges, as the execution privileges required by the system are involved. User interaction is not required for this exploitation. Product: Android...

Astra Linux – Vulnerability in Linux 5.10, Intel-Microcode

Incomplete cleanup of microarchitectural fill buffers on some Intel processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel versions 5.4 through 5.6.10, net/netfilter/nfdupnetdev.c allows local users to gain privileges due to a heap out-of-bounds write. This issue is related to nftablesoffload...

Astra Linux – vulnerability in intel-microcode

Incomplete cleanup in certain special register read operations on some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed an integer overflow in the regional allocator through the ALIGNUP macro. NOTE: The vendor denies that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be remotely or locally exploited...

Astra Linux – Vulnerability in multipath-tools

Multipath-tools versions 0.7.7 through 0.9.x, prior to 0.9.2, allowed local users to obtain root access. This vulnerability was exploited in conjunction with CVE-2022-41974. Local users who had access to /dev/shm could modify symlinks within multipathd due to incorrect symlink handling. This coul...

Astra Linux – Vulnerability in multipath-tools

In versions of multipath-tools from 0.7.0 to 0.9.x, up to 0.9.2, local users could obtain root access, either alone or in conjunction with CVE-2022-41973. Local users who had access to write to UNIX domain sockets could bypass access controls and manipulate the multipath setup. This could result ...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c within unixdiaggetexact in the Linux Kernel. The newly allocated skb lacks an “sk” field, resulting in a NULL pointer. This flaw may allow a local user to crash or potentially cause a denial of service...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fixed a use-after-free in localcleanup. A use-after-free occurs in kfreeskb called from localcleanup. This can occur when killing the nfc daemon e.g., neard after detaching an nfc device. When detaching an nfc device,...

Astra Linux – Vulnerability in Firefox

Insufficient validation in the Drag and Drop API, combined with social engineering, may have allowed an attacker to trick end-users into creating shortcuts to local system files. This could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 115...