Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: schsfb: Replace the direct dequeue call with peek and qdiscdequeuepeeked. When sfb has children e.g., qfq qdisc whose peek callback is qdiscpeekdequeued, we could encounter a kernel panic. When the parent of such qdisc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: Handle the cleanup after a zerocopy send occurs, before the message is queued. A zerocopy send can fail after user pages have been pinned, but before the message is attached to the sending socket. The purge path currentl...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: The RX buffers are refilled before being passed to XDP or used by an skb. The RX error path returns the current descriptor buffer to the BM pool. This only applies while the driver still owns the buffer. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: Failure to allocate TX rings during RX allocation. When the allocation of RX descriptor rings fails, the initdmadescrings function only frees the partially allocated RX rings and returns. However, the TX rings that we...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/802/mrp: Fixed the parsing of vector attributes in mrppduparsevecattr. In mrppduparsevecattr, vector attribute events are encoded three per byte, and valen tracks the number of events remaining to be processed. The parser...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net, bpf: A NULL check for the master parameter was missing in xdpmasterredirect. xdpmasterredirect dereferes the result of netdevmasterupperdevgetrcu without performing a NULL check. However, this helper function returns NULL wh...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, proper RCU protection was added to /proc/net/ptype. Yin Fengwei reported a RCU stall in ptypeseqshow, and provided a patch. The real issue lies in ptypeseqnext and ptypeseqshow, which violate RCU rules...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fixed a potential Use-After-Free UAF condition that could occur during the attach process when a meter is created. While creating a new meter using the attachmeter function, the new meter becomes visible to othe...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fqcodel: Clamp the default quantum and mtu. The fqcodelinit function sets q-quantum to pschedmtuqdiscdevsch, without clamping it. A device with a very large MTU e.g., a dummy device with maxmtu == 0 and an accepted...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved during initial packet parsing. This pointer is later dereferenced without being...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fixed the len check in receivebig. receivebig limits the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. This still results in an insufficient limit. addrecvbufbig sets sg1 to start at offset sizeofstru...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Net: Bridge: mcast: Fixed an issue where a use-after-free occurred with the multicast context of a master VLAN. The brmulticasttoggleonevlan function clears the BRVLFLAGMCASTENABLED flag under the br-multicastlock before...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: rds: Fixed the issue with MR cleanup when a copy error occurred. The function rdsrdmamap assigns ownership of sg/pages to the transport after getmr succeeds. If copying the generated cookie back to user space fails after...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Use RCU protection in ip6defaultadvmss. ip6defaultadvmss requires RCU protection to ensure that the network structure it reads does not disappear...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Net: Bridge – Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative integer, which is converted to an unsigned value when...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdplinearizepage, when reading the following buffers from the ring, we forget to check the received length against the actual allocated size. This can lead ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: A bug was fixed regarding a skb leak during the flow key update process. The ovsctexecute function always steals or frees the skb upon failure, whereas ovsflowkeyupdate does not do this. Therefore, if the functi...

Astra Linux – Vulnerability in Linux

A issue was discovered in netfilter within the Linux kernel before version 5.10. There may be a use-after-free situation in the packet processing context, as the per-CPU sequence count is mishandled during concurrent iptables rule replacements. This vulnerability could be exploited with the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: Protect flwalk with rcu. The patch that refactored flwalk to use idrforeachentrycontinueul also removed the rcu protection for individual filters. This caused a use-after-free when the filter was deleted...