Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Reallocate the update replies for mismatched IDs. The ovsflowcmdnew function preallocates the optional reply skb before acquiring the ovsmutex, and before determining which existing flow will be updated. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fqpie: Clamp the default quantum to avoid signed overflow. The fqpieinit function sets q-quantum = pschedmtuqdiscdevsch without clamping it. A device with a very large MTU e.g., a dummy device with maxmtu == 0 and a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: A logic flaw in smcsetsockopt allows a local unprivileged user to cause a Denial of Service DoS by holding the socket lock indefinitely. A logic flaw in smcsetsockopt allows a local unprivileged user to cause a Denial of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Socket creation is restricted to the initial network namespace. The QRTR protocol maintains its entire port and node state in global variables within the module, without being partitioned per network namespace...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fixed an OOB read issue in the NCSICMDSENDCMD payload length The ncsisendcmdnl function takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header. However, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: openvswitch: fixed the use of flow mask after it was freed upon flow deletion. The commit in the “Fixes” section schedules the freeing of flow-mask via RCU right after it is removed from the flow table. The pointer remain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net/sched module, there is a issue where sfq: clamping the quantum value can lead to a signed overflow condition, causing a soft lockup. The sfqinit function sets q-quantum to pschedmtuqdiscdevsch unsigned. A device with a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevents unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: added a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then used...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/smc: Fixed a use-after-free in smcrxpipebufrelease. The smcrxsplice function passes RMB pages to a pipe and takes a socket reference per entry. As a result, the smcsock remains alive until the reader finishes. The connecti...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fixed the race condition between smclistenout and listener close. smclistenout reads lsmc-sk.skstate without acquiring a lock on locksocknested. It only acquires the lock after the check passes. This creates a window...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/iucv: Filtering frames in afiucvhsrcv, based on the ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made to determine which netdevi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hsr: The operation of freeing the node table is deferred until after the RCU readers are called. Generic-netlink operations for hsrnodelist and hsrnodestatus are executed under rcureadlock. These operations iterate through...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net module, the guard timestamp cmsgs to real error queue skbs mechanism was addressed. The skbiserrqueue function treats PACKETOUTGOING as the only marker for an skb in the skerrorqueue. However, this assumption does not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: freeing stranded TX buffers on ring deinit The aqvecdeinit function drains the TX rings with a single aqringtxclean call. This frees at most AQCFGTXCLEANBUDGET 256 descriptors. However, the reference to hwhead...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: Handle the cleanup after a zerocopy send occurs, before the message is queued. A zerocopy send can fail after user pages have been pinned, but before the message is attached to the sending socket. The purge path currentl...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes. Currently, the name server does not limit the number of nodes it handles. This can be a potential attack vector if a malicious client starts registering random nodes, leading to...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: net/sched: schets: do not remove idle classes from the round-robin list Shuang reported that the following script: 1 tc qdisc add dev ddd0 handle 10: parent 1: ets bands 8 strict 4 priomap 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 2...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: The RX buffers are refilled before being passed to XDP or used by an skb. The RX error path returns the current descriptor buffer to the BM pool. This only applies while the driver still owns the buffer. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SCTP: Fixed an uninitialized value in sctprcvasconflookup. The sctprcvasconflookup function in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header. It then calls af-fromaddrparam,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: Failure to allocate TX rings during RX allocation. When the allocation of RX descriptor rings fails, the initdmadescrings function only frees the partially allocated RX rings and returns. However, the TX rings that we...