PT-2022-36284 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.156 Description: The issue is related to a possible memory leak caused by a missing pci dev put call. This problem was introduced in version v4.4 and is fixed in Linux Kernel version v5.10.156. The actual...

USN-5728-3: Linux kernel (GCP) vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

kernel: sfc: fix use after free when disabling sriov

In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf-pcidev: it was freed from pcidisablesriov and later read in efxef10sriovfreevfvports,...

SUSE-SU-2022:2880-1 Security update for dpdk

This update of dpdk fixes the following issue: - Fix to read PCI device name as UTF strings bsc1198873 - Allow configuring thread granularity of Kernel NIC Interface bsc1195172 - Rebuild with new secure boot key due to grub2 boothole 3 issues bsc1198581...

Xen PV Guest Non-SELFSNOOP CPU Memory Corruption Exploit

On CPUs without SELFSNOOP support, a Xen PV domain that has access to a PCI device which grants the domain the ability to set arbitrary cache attributes on all its pages can trick Xen into validating an L2 pagetable that contains a cacheline that is marked as clean in the cache but actually diffe...

Xen PV Guest Non-SELFSNOOP CPU Memory Corruption

Xen: PV guest on non-SELFSNOOP CPUs can validate non-coherent L2 pagetable I'm not sure whether there are any major users of unshimmed Xen PV left, but https://xenbits.xen.org/docs/unstable/support-matrix.html says it's still a security-supported usecase for 64-bit guests. Tested on Debian's Xen...

SUSE-SU-2022:1892-1 Security update for dpdk

This update for dpdk fixes the following issues: Security: - CVE-2021-3839: Fixed a memory corruption issue during vhost-user communication bsc1198963. - CVE-2022-0669: Fixed a denial of service that could be triggered by a vhost-user master bsc1198964. Bugfixes: - kni: allow configuring thread...

OPENSUSE-SU-2021:3968-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly XSA-386 bsc1191363. - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs XSA-388 bsc1192557. - CVE-2021-28705, CVE-2021-28709: Fixed issues...

SUSE-SU-2021:3888-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly XSA-386 bsc1191363. - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs XSA-388 bsc1192557. - CVE-2021-28705, CVE-2021-28709: Fixed issues...

SUSE-SU-2021:3852-1 Security update for xen

This update for xen fixes the following issues: - CVE-2021-28702: Fixed PCI devices with RMRRs not deassigned correctly XSA-386 bsc1191363. - CVE-2021-28704, CVE-2021-28707, CVE-2021-28708: Fixed PoD operations on misaligned GFNs XSA-388 bsc1192557. - CVE-2021-28705, CVE-2021-28709: Fixed issues...

SUSE-SU-2021:3388-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated. The following security bugs were fixed: - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:1142-1 Rating: important References: 1065729 1085224 1094840 1113295 1153274 1154353 1156395 1179243 1183871 1184114 1184350 1184631 1185377 1185902 1186194 1186264 1186482 1187476 1188101 1188405...

CVE-2021-3559

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices e.g., GRID driver. This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt...

Command injection

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices e.g., GRID driver. This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt...

CVE-2021-3559

CVE-2021-3559 : A flaw in libvirt’s virConnectListAllNodeDevices API affects hosts with PCI devices using mediated devices (e.g., GRID driver) and libvirt versions before 7.0.0. An unprivileged client with a read-only connection can crash the libvirt daemon by executing the nodedev-list command, ...

CVE-2021-3556

A flaw was found in libvirt in the virConnectListAllNodeDevices API. It only affects hosts with a PCI device and driver that supports mediated devices ex., GRID driver. This flaw allows an unprivileged client with a read-only connection to crash the libvirt daemon by executing the 'nodedev-list'...

openSUSE Security Update : monitoring-plugins-smart (openSUSE-2021-706)

This update for monitoring-plugins-smart fixes the following issues : monitoring-plugins-smart was updated to 6.9.1 : This is a security-release boo1183057 + Fixes the regular expression for pseudo-devices under the /dev/bus/N path. from 6.9.0 + Allows using PCI device paths as device names 64 +...

OPENSUSE-SU-2021:0706-1 Security update for monitoring-plugins-smart

This update for monitoring-plugins-smart fixes the following issues: monitoring-plugins-smart was updated to 6.9.1: This is a security-release boo1183057 + Fixes the regular expression for pseudo-devices under the /dev/bus/N path. from 6.9.0 + Allows using PCI device paths as device names 64 +...

Security update for monitoring-plugins-smart (important)

openSUSE Security Update: Security update for monitoring-plugins-smart Announcement ID: openSUSE-SU-2021:0706-1 Rating: important References: 1183057 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be...

Denial Of Service (DoS)

xen is vulnerable to denial of service. A domain with a passed through PCI device can cause lockup of a physical CPU, resulting in a Denial of Service DoS to the entire host...