CVE-2024-47732 crypto: iaa - Fix potential use after free bug

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix potential use after free bug The freedevicecompressionmodeiaadevice, devicemode function frees "devicemode" but it iss passed to iaacompressionmodesi-free a few lines later resulting in a use after free. The goo...

CVE-2024-47711 af_unix: Don't return OOB skb in manage_oob().

In the Linux kernel, the following vulnerability has been resolved: afunix: Don't return OOB skb in manageoob. syzbot reported use-after-free in unixstreamrecvurg. 0 The scenario is 1. sendMSGOOB 2. recvMSGOOB - The consumed OOB remains in recv queue 3. sendMSGOOB 4. recv - manageoob returns the...

CVE-2024-47697 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error

In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure index in rtl2830pidfilter does not exceed 31 to prevent out-of-bounds access. dev-filters is a 32-bit value, so setbit and clearbit functions should...

CVE-2024-47694 IB/mlx5: Fix UMR pd cleanup on error flow of driver init

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix UMR pd cleanup on error flow of driver init The cited commit moves the pd allocation from function mlx5rumrresourcecleanup to a new function mlx5rumrcleanup. So the fix in commit 1 is broken. In error flow, will hit...

CVE-2024-47694

CVE-2024-47694 affects the Linux kernel’s InfiniBand/RDMA stack, specifically mlx5-based drivers. The root cause is a broken UMR cleanup flow during driver init: the cited patch moved pd allocation to a new mlx5r_umr_cleanup() function, which could dereference a NULL pd in error paths, causing a ...

CVE-2024-47693 IB/core: Fix ib_cache_setup_one error flow cleanup

In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix ibcachesetupone error flow cleanup When ibcacheupdate return an error, we exit ibcachesetupone instantly with no proper cleanup, even though before this we had already successfully done gidtablesetupone, that results...

CVE-2024-47686 ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()

In the Linux kernel, the following vulnerability has been resolved: ep93xx: clock: Fix off by one in ep93xxdivrecalcrate The psc-div array has psc-numdiv elements. These values come from when we call clkhwregisterdiv. It's adcdivisors and ARRAYSIZEadcdivisors and so on. So this condition needs to...

CVE-2024-47679 vfs: fix race between evice_inodes() and find_inode()&iput()

In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between eviceinodes and findinode&iput Hi, all Recently I noticed a bug1 in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode ie ino 261 with icount 1 is called by iput, and...

CVE-2024-47674 mm: avoid leaving partial pfn mappings around in error case

In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw...

ROS-20241015-03

Nomad application orchestrator vulnerability related to improper link resolution before accessing a file. Exploitation of the vulnerability could allow an attacker acting remotely, allowing an attacker to execute arbitrary code...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-46713 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd CVE-2024-46734 In the...

Medium: python-dns

Issue Overview: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-43855)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43855 advisory. - In the Linux kernel, the following vulnerability has been resolved: md: fix deadlock between mddevsuspend an...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-43860)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43860 advisory. - In the Linux kernel, the following vulnerability has been resolved: remoteproc: imxrproc: Skip over memory...

CVE-2024-47662

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection Why These registers should not be read from driver and triggering the security violation when DMCUB work times out and diagnostics are collected blocks Z8...

CVE-2024-45315

The Improper link resolution before file access 'Link Following' vulnerability in SonicWall Connect Tunnel version 12.4.3.271 and earlier of Windows client allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service DoS attack...

CVE-2024-45316

The Improper link resolution before file access 'Link Following' vulnerability in SonicWall Connect Tunnel version 12.4.3.271 and earlier of Windows client allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack...

CVE-2024-45315

The Improper link resolution before file access 'Link Following' vulnerability in SonicWall Connect Tunnel version 12.4.3.271 and earlier of Windows client allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service DoS attack...

SonicWALL Connect Tunnel 后置链接漏洞

SonicWALL Connect Tunnel is a remote software from SonicWALL USA. A backlink vulnerability exists in SonicWALL Connect Tunnel version 12.4.3.271 and earlier, which stems from the presence of a File Access Before Link Resolution Incorrect vulnerability that allows users with standard privileges to...

SonicWALL Connect Tunnel 后置链接漏洞

SonicWALL Connect Tunnel is a remote software from SonicWALL USA. A backlink vulnerability exists in SonicWALL Connect Tunnel version 12.4.3.271 and prior versions, which stems from the presence of an incorrect link resolution before file access vulnerability that could allow a user with standard...