Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rtc: mt6397: Check the return value after calling platformgetresource. If platformgetresource returns NULL, it may lead to a nullptrderef issue. Therefore, we need to check the return value...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: A leak has been prevented in itsvpeirqdomainalloc. When itsirqgicdomainalloc fails, itsvpeirgdomainfree fails to invoke itsvepteardown for the corresponding interrupt, resulting in a resource leak. Invoke...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pcmcia: A NULL pointer dereferencing was fixed in iodynfindioregion. In iodynfindioregion, pcmciamakeresource is assigned to res and used in pciBusallocResource. There is a dereferencing of res in pciBusallocResource, which could...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mctp: route: hold key-lock in mctpflowprepareoutput The mctpflowprepareoutput function checks key-dev and may call mctpdevsetkey. However, it does not hold key-lock during this process. Both mctpdevsetkey and mctpdevreleasekey...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - net: dsa: felix: do not use devres for mdiobus. As explained in the commits: - 74b6d7d13307: “net: dsa: realtek: register the MDIO bus using devres”. - 5135e96a3dd2: “net: dsa: do not allocate the slavemiibus using devres”...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Rejects adapter interrupt forwarding if it is already enabled. The MPCIFC instruction does not allow registering adapter interrupts without first unregistering them. Therefore, any request to enable interrupt...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Drivers: mcb: fixed a resource leak in mcbprobe When the probe hook function failed in mcbprobe, the device was not added to the list of devices available for use. Compiled test only...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Viawdt: fixed a critical boot hang caused by unnamed resource allocation. The VIA watchdog driver uses allocateresource to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: imx: Do not skip cleanup in the error path of the remove function Returning early in the remove callback of a platform driver is incorrect. In this case, the DMA resources are not released during the error path. This issue i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fixed possible resource leaks in mpt3sastransportportadd. In mpt3sastransportportadd, if sasrphyadd returns an error, sasrphyfree must be called to free the resources allocated in sasenddevicealloc. Otherwise, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: A possible null-ptr-deref issue has been fixed in cadencenanddtprobe. This issue could lead to a null-ptr-deref when using ‘res’. If platformgetresource returns NULL, moving using ‘res’ after...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd-mbhc-v2: fixed resource leaks during component removal. The MBHC resources must be released in case of component probe failures and removals; therefore, they cannot be tied to the lifetime of the component devic...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfc: Fixed potential resource leaks nfcgetdevice now takes a reference to the device and adds it; nfcputdevice is added to release it when no longer needed. Additionally, the warning message was corrected by using the error co...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/i915/gt: Handling cleanup of partially initialized engines If we abort the driver initialization during the process of engine discovery, some engines will be fully initialized while others will not. Those incompletely...

Astra Linux – Vulnerability in JRuby

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby, up to 3.2.1. The URI parser improperly handles invalid URLs that contain specific characters. This leads to an increase in the execution time required to parse strings into URI objects. The fixed versions are 0.12.1, 0.11.1...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Do not leak a resource on eviction error. For eviction errors other than -EMULTIHOP, we were leaking a resource. This issue has been fixed. v2: - Avoid using another “goto” statement. Andi Shyti...

Astra Linux – Vulnerability in Zabbix

The URL validation scheme receives input from a user and then parses it to identify its various components. This validation scheme ensures that all URL components comply with internet standards...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Ice: Fixed the resource leak in the iceresetallvfs function due to FDIR filters being enabled. Enabling FDIR filters causes a resource leak because the CTRL VSIs are only invalidated rather than actually freed. The issue was fixe...

Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 152.0.7977.65, an uninitialized resource in the GPU allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A flaw was discovered in the IPv4 Resource Reservation Protocol RSVP classifier within the Linux kernel. The xprt pointer may extend beyond the linear portion of the skb structure, resulting in an out-of-bounds read in the rsvpclassify function. This issue could potentially cause a local user to...