Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb/client: Avoid referencing rdata=NULL in smb2newreadreq. This occurs when calling from SMB2read while using rdma, and when reaching the rdmareadwritethreshold...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hamradio: 6pack: fixed an issue with uninit-value in sixpackreceivebuf The sixpackreceivebuf function does not properly skip bytes that occur due to TTY error flags. The while loop iterates through the flags buffer but never...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: libceph: Two unsafe bare decode operations in decodelockers were fixed. The decodelockers function in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger a slab-out-of-bound...

Astra Linux – Vulnerability in Chromium

Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210ahub: Validates the written enum value. The tegraahubputvalueenum function reads e-valuesitem0 before checking whether item0 is within the enum item range. As a result, the existing check happens too late,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvme-tcp: fixed UAF Use-after-Free issues when detecting digest errors. We should also exit the iowork loop when setting rdenabled to true, so that we do not attempt to read data from the socket when the TCP stream is already...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: hrtimers: Timers queued after CPUHPAPHRTIMERSDYING are forced to be migrated away from the dying CPU to any online target. This is done to avoid delaying bandwidth timer handling tasks related to CPU hotplug progress. However,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: IB/isert: Rejects login PDUs that declare more data than was actually received. The isertloginrecvdone function records how many bytes the HCA actually places into the login buffer. However, nothing compares this value to the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: udf: The validation of the VAT header length is performed based on the VAT inode size. The udfloadvat function retrieves the start offset of the virtual partition directly from the disk’s VAT 2.0 header, without checking it again...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The cached volume label is terminated after the UTF-8 conversion. The ntfsfillsuper function loads the disk-based volume label using utf16stoutf8s, and stores the result in sbi-volume.label. The converted label is later...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. The vulnerability is difficult to exploit; an unauthenticated...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed an out-of-bounds read in ext4readInlineDir. ext4readInlineDir can read a dirent header that extends beyond the end of its inline buffer, leading to an out-of-bounds read during getdents64. Bug: KASAN: Out-of-bounds...

Astra Linux – Vulnerability in Chromium

Before version 153.0.8010.36, reading data from out of bounds locations in Google Chrome allowed a remote attacker to read memory outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: comedi: Make insnrwemulatebits handle insn-n samples. The insnrwemulatebits function is used as a default handler for INSNREAD instructions for sub-devices that have a handler for INSNBITS but not for INSNREAD. Similarly, it is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackirc: Fixed an issue where parsedcc might perform an out-of-bounds read due to an off-by-one error. parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate the ATRREQ length against the received frame The st21nfcatmrecvatrreq function checks that the received ATRREQ frame is at least ST21NFCAATRREQMINSIZE in length, and that the self-declared atrreq-length is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading the conf opt value The l2capgetconfopt function derives the option length from the attacker-controlled opt-len field. It immediately dereferes opt-val as a u8, using...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen – Clamps datalen/xlen to the urb buffer size. The nexioreaddata function extracts datalen and xlen from a packed be16 header in the device’s interrupt packet. It then iterates through the packet-data0..xlen...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: The decoding of the “bound getversion reply” was incorrect. The handlegetversionreply function uses msg-frontalloclen as the boundary for decoding MONGETVERSIONREPLY. This represents the size of the reused reply buffer,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: orangefs: Keep the readdir entry size as 64-bit in fillfrompart. fillfrompart calculates the size of a directory entry using the sizet type, but stores it as an u32 value. A value close to U32MAX causes the entry length to be...