Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free Read in tipcnamedreinit syzbot found the following issue on: ================================================================== BUG: KASAN: use-after-free in tipcnamedreinit+0x94f/0x9b0...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct using a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowloc...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: The ath5k driver seems to perform an array-index-out-of-bounds access, as indicated by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fixed a use-after-free issue when reverting the termination table. When there are multiple destinations with termination tables, and the second one or later fails, the driver reverts the use of termination tables, but...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: taprio: improper checking of the TCATAPRIOTCENTRYINDEX attribute The taprioparsetcentry function does not correctly check the TCATAPRIOTCENTRYINDEX attribute: int tc; // Signed value tc =...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket failed to bind a protocol. Consequently, protocol-bound SOCKRAW sockets, any...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a brief period between when a net device begins to be unregistered and when it actually disappears. During this time, ethtool operations may still be...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: net/sched: schets: do not remove idle classes from the round-robin list Shuang reported that the following script: 1 tc qdisc add dev ddd0 handle 10: parent 1: ets bands 8 strict 4 priomap 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 2...

Astra Linux - vulnerability in linux

An issue was found in the Linux kernel prior to version 5.11.11. In net/qrtr/qrtr.c, the rtrtrrecvmsg function allows attackers to extract sensitive information from kernel memory due to a partially uninitialized data structure, identified as CID-50535249f624...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the net/sched/schcbq.c file of the Linux kernel, from version 6.1.4 onwards, cbqclassify allows attackers to cause a denial of service due to type confusion. Non-negative numbers can sometimes indicate a TCACTSHOT condition instead of valid classification results...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15

An issue was found in the Linux kernel up to version 6.0.9. In drivers/media/dvb-core/dvbnet.c, there is a race condition involving .disconnect versus dvbdeviceopen, which can lead to use-after-free...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c within unixdiaggetexact in the Linux Kernel. The newly allocated skb lacks an “sk” field, resulting in a NULL pointer. This flaw may allow a local user to crash or potentially cause a denial of service...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fixed the lockdep issue in qdisctreereducebacklog The qdisctreereducebacklog function is called with the qdisc lock held; this issue was not addressed in the previous version. We must use qdisclookuprcu instead of...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel prior to version 5.17.1, a refcount leak bug was found in net/llc/afllc.c...

Astra Linux – vulnerability in golang-golang-x-net

Go’s net/http versions prior to 1.16.12 and 1.17.x prior to 1.17.5 allow uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

Astra Linux – Vulnerability in golang-golang-x-net

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service infinite loop by using crafted ParseFragment inputs...

Astra Linux – Vulnerability in golang-golang-x-net, golang-1.15

In Go, before versions 1.15.12 and 1.16.x, and before version 1.16.4, net/http allowed remote attackers to cause a denial of service panic through a large header sent to ReadRequest or ReadResponse. This issue can affect the Server, Transport, and Client components in certain configurations...

USN-8883-2 golang-1.23 vulnerability

USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This update provides the corresponding fix for Go version 1.23. Original advisory details: It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. ...