kernel: tcp: add sanity checks to rx zerocopy

A vulnerability was found in Linux Kernel where rx zerocopy feature allowed mapping of pages owned by the filesystem, leading to potential system panic which is caused by the lack of sanity checks to rx zerocopy. A local authenticated attacker could exploit this vulnerability to cause a denial of...

CLSA-2024-1731430561 kernel: Fix of 31 CVEs

driver core: bus: Fix double free in driver API busregister CVE-2024-50055 - net: tun: Fix use-after-free in tundetach CVE-2022-49014 - memcg: fix possible use-after-free in memcgwriteeventcontrol CVE-2022-48988 - ppp: fix pppasyncencode illegal access CVE-2024-50035 - drivers: media:...

kernel: drm/radeon: fix UBSAN warning in kv_dpm.c

A vulnerability was found in the Linux kernel's DRM/Radeon driver, specifically in the sumovidmappingentry within the kvdpm.c file. Insufficient bounds checking can lead to memory corruption...

kernel: cxl/region: Avoid null pointer dereference in region lookup

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Avoid null pointer dereference in region lookup cxldpatoregion looks up a region based on a memdev and DPA. It wrongly assumes an endpoint found mapping the DPA is also of a fully assembled region. When not true it...

kernel: drm/amdgpu: validate the parameters of bo mapping operations more clearly

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters of amdgpuvmbomap/replacemap/clearingmappings in one common place...

kernel: dax: Fix dax_mapping_release() use after free

A use-after-free vulnerability was found in the Linux kernel's device-dax subsystem during mapping object cleanup. When removing a dax region provider, the child daxmapping objects attempt to free their ID allocator after the parent devdax object has already been released. This causes idafree to...

kernel: net: atlantic: Fix DMA mapping for PTP hwts ring

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aqringhwtsrxalloc maps extra AQCFGRXDSDEF bytes for PTP HWTS ring but then generic aqringfree does not take this into account. Create and use a specific function to free...

kernel: mm/page_table_check: fix crash on ZONE_DEVICE

A vulnerability was found in the Linux kernel's mm/pagetablecheck component, specifically related to ZONEDEVICE pages. When page-table-check is enabled, attempting to map DAX memory can lead to a kernel crash due to invalid checks on these pages, which do not allocate pageext...

kernel: nfs: pass explicit offset/count to trace events

nfs in linux kernel permits using nfsfoliolength without locking the folio and without checking for null mapping. This can permit truncation and lead to kernel crash...

kernel: io_uring: Fix release of pinned pages when __io_uaddr_map fails

A flaw was found in the iouring subsystem in the Linux kernel, where pinned pages are not properly released if the iouaddrmap function fails. This could lead to resource leaks or other unintended behaviors...

kernel: drm/amdgpu: add error handle to avoid out-of-bounds

A flaw was found in the Linux kernel's drm/amdgpu component. This vulnerability, caused by an out-of-bounds read in the sdmav40irqidtoseq function, could allow a local attacker to read sensitive information from kernel memory. This could lead to information disclosure or a denial of service DoS d...

kernel: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section

In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section is a dummy PE section that contains the address of the 32-bit entrypoint of the 64-bit kernel image if it is bootable from 32-bit firmware...

CVE-2024-50250

A buffer overrun exists in the Linux kernel. When pos and len are passed to daxfileunshare, they are not aligned to an fsblock boundary, and the iteration of pos and length in the iter function will reflect this. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2024-50250

In the Linux kernel, the following vulnerability has been resolved: fsdax: daxunshareiter needs to copy entire blocks The code that copies data from srcmap to iomap in daxunshareiter is very very broken, which bfoster's recent fsx changes have exposed. If the pos and len passed to daxfileunshare...

UBUNTU-CVE-2024-50250

In the Linux kernel, the following vulnerability has been resolved: fsdax: daxunshareiter needs to copy entire blocks The code that copies data from srcmap to iomap in daxunshareiter is very very broken, which bfoster's recent fsx changes have exposed. If the pos and len passed to daxfileunshare...

CVE-2024-50250 fsdax: dax_unshare_iter needs to copy entire blocks

In the Linux kernel, the following vulnerability has been resolved: fsdax: daxunshareiter needs to copy entire blocks The code that copies data from srcmap to iomap in daxunshareiter is very very broken, which bfoster's recent fsx changes have exposed. If the pos and len passed to daxfileunshare...

CVE-2024-50250

The CVE-2024-50250 issue affects the Linux kernel fsdax code: dax_unshare_iter copies data from srcmap to iomap and previously did not align copy_pos/copy_len to a page boundary, allowing misalignment when iter->pos and length are not page-aligned. The bug can cause data corruption (when iter-...

device-dax: correct pgoff align in dax_set_mapping()

...

DEBIAN-CVE-2024-50211

In the Linux kernel, the following vulnerability has been resolved: udf: refactor inodebmap to handle error Refactor inodebmap to handle error since udfnextaext can return error now. On situations like ftruncate, udfextendfile can now detect errors and bail out early without resorting to checking...

UBUNTU-CVE-2024-50211

In the Linux kernel, the following vulnerability has been resolved: udf: refactor inodebmap to handle error Refactor inodebmap to handle error since udfnextaext can return error now. On situations like ftruncate, udfextendfile can now detect errors and bail out early without resorting to checking...