Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: e1000: fixed an out-of-bounds error in e1000tbishouldaccept In e1000tbishouldaccept, we read the last byte of the frame via “datalength - 1” to evaluate the TBI workaround. If the descriptor’s reported length is zero or greater...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hamradio: 6pack: fixed an issue with uninit-value in sixpackreceivebuf The sixpackreceivebuf function does not properly skip bytes that occur due to TTY error flags. The while loop iterates through the flags buffer but never...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: hfsplus: removing WARNON from hfspluscatread,writeinode. The syzbot tool encounters WARNON in hfspluscatread,writeinode, where a crafted filesystem image may contain invalid lengths. These conditions do not constitute kernel...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevented possible UAF in ip6xmit If skbexpandhead returns NULL, the skb has been freed, and the associated dst/idev may also have been freed. We must use rcureadlock to prevent possible UAF...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: libceph: Two unsafe bare decode operations in decodelockers were fixed. The decodelockers function in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger a slab-out-of-bound...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The boundattroff variable in UpdateResidentValue was corrected to use dataoff. In the UpdateResidentValue function in doaction, lrh-attroff and lrh-redolen originate from the disk-based LRH structure. When aoff + dlen...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Validated the length of the embedded INIT chunk and the length of the address list in the cookie. sctpunpackcookie only checks that the length of the embedded INIT chunk does not exceed the remaining cookie payload, but...

Astra Linux – Vulnerability in Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ELF: fixed the double read of kernel.randomizevaspace. The ELF loader uses “randomizevaspace” twice. This is a sysctl setting that can be changed at any time; therefore, two reads could potentially access different values,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: The IORINGOPREAD function did not correctly handle the provided buffer list when the read I/O operation returned a value less than 0 except for the -EAGAIN and -EIOCBQUEUED returns. This could lead to a potential “use-after-free”...

Astra Linux – Vulnerability in tar

GNU Tar version 1.34 has a one-byte out-of-bounds read operation that allows for the use of uninitialized memory during a conditional jump. Exploitation to alter the control flow has not been demonstrated. The issue occurs in the fromheader section of the list.c file, due to a V7 archive where...

Astra Linux – Vulnerability in p7zip

Ppmd7.c in 7-ZIP before 23.00 allows for integer underflow and invalid read operations due to a crafted 7Z archive...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fpga: microchip-spi: fixed the issue where zero headersize OOB read was performed in mpfopsParseHeader. The mpfopsParseHeader function reads headersize from the bitstream at MPFHEADERSIZEOFFSET 24. When headersize is zero, the...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The affected versions have a flaw in offset validation, which can lead to an out-of-bounds read. In the libfreerdp/codec/rfx.c file, there is no validation for the offsets in tile-quantIdxY,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: HID: cp2112: prevented a buffer overflow in cp2112xfer Matching warnings: drivers/hid/hid-cp2112.c:793 cp2112xfer error: memcpy 'data-block1' is too small 33 vs 255 drivers/hid/hid-cp2112.c:793 cp2112xfer error: memcpy 'buf' i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: UBTMC: Check URB actuallength for interrupt-IN notifications. USB UBTMC devices can use an optional interrupt endpoint for notification messages. These messages typically contain two-byte headers that indicate the payload...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: For the cdrom function, the issue of out-of-bounds read from the stack was addressed in CDROMVOLCTRL. The mmcioctlcdromvolume function first reads the audio control mode page into a 32-byte stack buffer, with cgc-buflen set to 24...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read The udfsymlinkfiller function can access udfpctochar with a partially completed pathComponent header. It is necessary to validate that there is sufficient remaining input to complete the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen was adjusted to avoid reading OOB sense-data. In qla2x00statusentry, the FWI2 status path increments sensedata and reduces parsenselen by rspinfolen: c if ISFWI2CAPABLEha sensedata += rspinfolen;...

Astra Linux – Vulnerability in Chromium

Before version 143.0.7499.147, read and write access in V8 using Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: A potential use-after-free issue has been addressed in nilfsgccachesubmitreaddata. In nilfsgccachesubmitreaddata, the function brelsebh is called to decrement the reference count of bh when the call to nilfsdattranslate...