DEBIAN-CVE-2024-50020

In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in icesriovsetmsixveccount This patch addresses an issue with improper reference count handling in the icesriovsetmsixveccount function. First, the function calls icegetvfbyid, which...

UBUNTU-CVE-2024-50020

In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in icesriovsetmsixveccount This patch addresses an issue with improper reference count handling in the icesriovsetmsixveccount function. First, the function calls icegetvfbyid, which...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from improper handling of reference counts in the icesriovsetmsixveccount function, which could lead to a reference...

October 8, 2024—KB5044281 (OS Build 20348.2762)

None None...

PT-2024-33861

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.11.3 Description: The issue concerns improper reference count handling in the ice sriov set msix vec count function. This can lead to reference count leaks under certain conditions, such as when ice get vf vsi...

UBUNTU-CVE-2024-46761

In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnvphp: Fix hotplug driver crash on Powernv The hotplug driver for powerpc pci/hotplug/pnvphp.c causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because...

Cybercriminals Exploit Popular Software Searches to Spread FakeBat Malware

Cybersecurity researchers have uncovered a surge in malware infections stemming from malvertising campaigns distributing a loader called FakeBat. "These attacks are opportunistic in nature, targeting users seeking popular business software," the Mandiant Managed Defense team said in a technical...

AZL-48514 CVE-2024-43824 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

DEBIAN-CVE-2024-43824

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epcfeatures' in pciepftestcoreinit Instead of getting the epcfeatures from pciepcgetfeatures API, use the cached pciepftest::epcfeatures value to avoid the NULL check. Since the NU...

PT-2024-27497

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A vulnerability in the Linux kernel has been resolved. The issue occurs when request irq fails, causing an error path that calls vp del vqs, which attempts to free an already freed IRQ, resulti...

FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT

The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT. "The threat actors used malicious websites to impersonate well-known brands,...

Stories from the SOC Part 2: MSIX Installer Utilizes Telegram Bot to Execute IDAT Loader

Rapid7’s Managed Detection and Response MDR team continuously monitors our customers' environments, identifying emerging threats and developing new detections. In August 2023, Rapid7 identified a new malware loader named the IDAT Loader. Malware loaders are a type of malicious software designed t...

SUSE CVE-2021-47141

In the Linux kernel, the following vulnerability has been resolved: gve: Add NULL pointer checks when freeing irqs. When freeing notification blocks, we index priv-msixvectors. If we failed to allocate priv-msixvectors see abortwithmsixvectors this could lead to a NULL pointer dereference if the...

UBUNTU-CVE-2021-47141

In the Linux kernel, the following vulnerability has been resolved: gve: Add NULL pointer checks when freeing irqs. When freeing notification blocks, we index priv-msixvectors. If we failed to allocate priv-msixvectors see abortwithmsixvectors this could lead to a NULL pointer dereference if the...

FakeBat delivered via several active malvertising campaigns

February was a particularly busy month for search-based malvertising with the number of incidents we documented almost doubling. We saw similar payloads being dropped but also a few new ones that were particularly good at evading detection. One malware family we have been tracking on this blog is...

CVE-2021-46918

A flaw was found in the Linux Kernel. The current code leaves the MSIX enabled and the pasid entries still programmed at device shutdown. Add disabling/clearing of MSIX permission entries on device shutdown to mirror the enabling of the MSIX entries on probe...

CVE-2021-46918

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: clear MSIX permission entry on shutdown Add disabling/clearing of MSIX permission entries on device shutdown to mirror the enabling of the MSIX entries on probe. Current code left the MSIX enabled and the pasid...

CVE-2021-46918

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: clear MSIX permission entry on shutdown Add disabling/clearing of MSIX permission entries on device shutdown to mirror the enabling of the MSIX entries on probe. Current code left the MSIX enabled and the pasid...

CVE-2021-46918 dmaengine: idxd: clear MSIX permission entry on shutdown

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: clear MSIX permission entry on shutdown Add disabling/clearing of MSIX permission entries on device shutdown to mirror the enabling of the MSIX entries on probe. Current code left the MSIX enabled and the pasid...

CVE-2021-46918

CVE-2021-46918 is a Linux kernel vulnerability in the IDXDMA/DMAR DMA engine where MSIX permission entries were not cleared on device shutdown. The issue arose because MSIX entries were left enabled and pasid entries remained programmed when the device shut down, potentially enabling persistence ...