Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection must retain bnepsessionsem while reading dev-name, just as bnepgetconnlist does; otherwise the bnepsession thread may concurrently free the netdevice, which could be...

Astra Linux – vulnerability in gnutls28

A flaw in GnuTLS’s DTLS handshake parsing allows malformed fragments with zero length and non-zero offset. This leads to an integer underflow during reassembly, resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix use-after-free by using callrcu for oplockinfo Currently, ksmbd frees oplockinfo immediately using kfree, even though it is accessed under RCU read-side critical sections in functions such as opinfoget and procshowfile...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fsinodeinfo in f2fsfreedic The decompressioctx may be released asynchronously after I/O completion. If this file is deleted immediately after reading, and the kworker responsible for processing...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read bootblock when mounting During mounting, sb-sblocksize is used to read the bootblock without being defined or validated. Set a dummy blocksize before attempting to read the bootblock. The issue c...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusbwork maps the number of active SCO links to USB alternate settings via a three-entry lookup table when CVSD traffic uses transparent voice settings. Currently, the lookup...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-adc161s626: use DMA-safe memory for spiread Add a DMA-safe buffer and use it for spiread instead of stack memory. All SPI buffers must be DMA-safe. Since we only need up to 3 bytes, we simply use a u8 instead of be16...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one error in the meta encoder could lead to an out-of-bounds read of a single byte within the meta encoder. This issue has been fixed in versions...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen – Clamp NEXIO datalen/xlen to the URB buffer size nexioreaddata extracts datalen and xlen from a packed be16 header within the device’s interrupt packet; it then iterates through packet-data0..xlen and...

Astra Linux – vulnerability in xwayland, xorg-server

A out-of-bounds read flaw was found in the X.Org X server and Xwayland within glXDispChangeDrawableAttributes. An incorrect size validation check allows reading a client-controlled number of bytes beyond the request buffer, resulting in information disclosure. A write path also exists; however, i...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ibmasm: Fix OOB reads in commandfilewrite due to missing size checks The commandfilewrite handler allocates a kernel buffer of exactly count bytes and copies user data into it; however, it fails to validate the buffer against the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code is actually designed to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans sndusbmidigetmsinfo validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID, but the descriptor walker can still return a class-specific...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFSUUIDKEYRECEIVEDSUBVOL, we must abort the transaction since we perform...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvmedbbufset dev-onlinequeues is a count incremented in nvmeinitqueue. Thus, valid indices are 0 through dev-onlinequeues − 1. This patch fixes the loop condition to ensure the index stays with...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ntfs3: add buffer boundary checks to rununpack rununpack checks runbuf runlast at the top of the while loop but then reads sizesize and offsetsize bytes via rununpacks64 without verifying they fit within the remaining buffer. A...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ulemandatoryexthandlers and uleoptionalexthandlers tables in handleoneuleextension are declared with 255 elements valid indices 0-254, but the index htype is deriv...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmuctx-pmu for groups Oliver reported that x86pmudel ends up performing an out-of-bounds memory access when groupschedin fails and needs to roll back. This should be handled by the transaction callbacks, bu...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvmeprreadkeys nvmeprreadkeys takes numkeys from userspace and uses it to calculate the allocation size for rse via structsize. The upper limit is PRKEYSMAX 64K. A malicious or buggy userspace can...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43rx The firmware-controlled key index in b43rx can exceed the dev-key array size 58 entries. The existing B43WARNON is non-enforcing in production builds, allowing an...