USN-7303-1 linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Drivers cor...

DEBIAN-CVE-2022-49297

In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca 884 "echo 0...

DEBIAN-CVE-2022-49295

In the Linux kernel, the following vulnerability has been resolved: nbd: call genlunregisterfamily first in nbdcleanup Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BUG: kernel NULL pointer dereference, address:...

DEBIAN-CVE-2022-49300

In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing, nbdallocconfig may be called concurrently by nbdgenlconnect, although trymoduleget will return false, but nbdallocconfig doesn't handle it...

UBUNTU-CVE-2022-49297

In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca 884 "echo 0...

CVE-2022-49300 nbd: fix race between nbd_alloc_config() and module removal

In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbdallocconfig and module removal When nbd module is being removing, nbdallocconfig may be called concurrently by nbdgenlconnect, although trymoduleget will return false, but nbdallocconfig doesn't handle it...

CVE-2022-49295 nbd: call genl_unregister_family() first in nbd_cleanup()

In the Linux kernel, the following vulnerability has been resolved: nbd: call genlunregisterfamily first in nbdcleanup Otherwise there may be race between module removal and the handling of netlink command, which can lead to the oops as shown below: BUG: kernel NULL pointer dereference, address:...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an nbd device disconnecting that could cause an IO hang...

USN-7276-1: Linux kernel vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nbd: fixed the race condition between timeout and normal completion. If the request for a timeout is handled by nbdrequeuecmd, normal completion must be stopped to avoid completing this queued request. This could potentially...

The vulnerability of the nbd_disconnect_and_put() function in the /drivers/block/nbd.c component of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the nbddisconnectandput function in the /drivers/block/nbd.c component of the Linux kernel is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-30857

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description The Linux kernel contains a use-after-free issue within the network block device nbd module. Specifically, the nbd genl connect function does not properly stop the device on certain erro...

QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service DoS attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline...

The vulnerability of the nbd component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the nbd component in the Linux operating system’s kernel is related to improper error handling in the nbdgenlstatus function. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: nbd: always initialize struct msghdr completely

In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg-msggetinq value can be uninitialized 1 struct msghdr got many new fields recently, we should always make sure their values is zero by default. 1 BUG: KMSAN...

nbd: fix race between timeout and normal completion

...

Security update for qemu

This update for qemu fixes the following issues: CVE-2024-8354: Fixed assertion failure in usbepget bsc1230834. CVE-2024-8612: Fixed nformation leak in virtio devices bsc1230915. CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure bsc122900...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:3470)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3470 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:3472)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3472 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provi...

SUSE CVE-2024-49855

In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbdrequeuecmd, normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix t...