Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Net: Bridge – Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative integer, which is converted to an unsigned value when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: Rounding up the PTP per-out pin duration The pinduration is converted from the period provided by the user to SJA1105 clock ticks. This value is then passed as the cycletime parameter to futurebasetime. Very...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Reallocate the update replies for mismatched IDs. The ovsflowcmdnew function preallocates the optional reply skb before acquiring the ovsmutex, and before determining which existing flow will be updated. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fqpie: Clamp the default quantum to avoid signed overflow. The fqpieinit function sets q-quantum = pschedmtuqdiscdevsch without clamping it. A device with a very large MTU e.g., a dummy device with maxmtu == 0 and a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: A logic flaw in smcsetsockopt allows a local unprivileged user to cause a Denial of Service DoS by holding the socket lock indefinitely. A logic flaw in smcsetsockopt allows a local unprivileged user to cause a Denial of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Socket creation is restricted to the initial network namespace. The QRTR protocol maintains its entire port and node state in global variables within the module, without being partitioned per network namespace...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fixed an OOB read issue in the NCSICMDSENDCMD payload length The ncsisendcmdnl function takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header. However, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: openvswitch: fixed the use of flow mask after it was freed upon flow deletion. The commit in the “Fixes” section schedules the freeing of flow-mask via RCU right after it is removed from the flow table. The pointer remain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net/sched module, there is a issue where sfq: clamping the quantum value can lead to a signed overflow condition, causing a soft lockup. The sfqinit function sets q-quantum to pschedmtuqdiscdevsch unsigned. A device with a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevents unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: added a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then used...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/smc: Fixed a use-after-free in smcrxpipebufrelease. The smcrxsplice function passes RMB pages to a pipe and takes a socket reference per entry. As a result, the smcsock remains alive until the reader finishes. The connecti...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fixed the race condition between smclistenout and listener close. smclistenout reads lsmc-sk.skstate without acquiring a lock on locksocknested. It only acquires the lock after the check passes. This creates a window...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/iucv: Filtering frames in afiucvhsrcv, based on the ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made to determine which netdevi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hsr: The operation of freeing the node table is deferred until after the RCU readers are called. Generic-netlink operations for hsrnodelist and hsrnodestatus are executed under rcureadlock. These operations iterate through...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net module, the guard timestamp cmsgs to real error queue skbs mechanism was addressed. The skbiserrqueue function treats PACKETOUTGOING as the only marker for an skb in the skerrorqueue. However, this assumption does not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: freeing stranded TX buffers on ring deinit The aqvecdeinit function drains the TX rings with a single aqringtxclean call. This frees at most AQCFGTXCLEANBUDGET 256 descriptors. However, the reference to hwhead...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: Handle the cleanup after a zerocopy send occurs, before the message is queued. A zerocopy send can fail after user pages have been pinned, but before the message is attached to the sending socket. The purge path currentl...

Astra Linux – Vulnerability in golang-golang-x-net

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service infinite loop by using crafted ParseFragment inputs...

Astra Linux – Vulnerability in golang-golang-x-net, golang-1.15

In Go, before versions 1.15.12 and 1.16.x, and before version 1.16.4, net/http allowed remote attackers to cause a denial of service panic through a large header sent to ReadRequest or ReadResponse. This issue can affect the Server, Transport, and Client components in certain configurations...

Astra Linux – vulnerability in golang-golang-x-net

Go’s net/http versions prior to 1.16.12 and 1.17.x prior to 1.17.5 allow uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...