Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: inet: Sk-skrxdst was converted to RCU rules. The syzbot reported various issues related to early demux processing. One of these issues is included in this changelog 1. Sk-skrxdst uses RCU protection without proper documentatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tcpbpf: Fixed the skmemuncharge logic in tcpbpfsendmsg. The current sk memory accounting logic in SKREDIRECT involves pre-charging bytes to be sent, where the value is either msg-sg.size or a smaller value, applybytes. Potential...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed issues related to data races around sysctltcprecovery. When reading sysctltcprecovery, it can be changed concurrently. Therefore, we need to add READONCE to its readers...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: xfrm: Reinjecting transport-mode packets through the workqueue. The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: Soft lockup – CPU0 stuck for 22...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mptcp: Use the appropriate destructor for IPv6. Previously, only the destructor from the TCP request sock in IPv4 was called, even if the subflow was IPv6. It is important to use the correct destructor to avoid memory leaks with...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsitcp: It is necessary to check that sock is valid before assigning it to iscsisetparam. The validity of sock should be checked before assigning it to prevent incorrect values. The change introduced in commit 57569c37f0a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Net: Consume xmit errors of GSO frames. udpgrofrglist.sh and udpgrobench.sh are the most flaky tests currently in NIPA. They fail in exactly the same way. The TCP GRO test occasionally stalls, and the test terminates after 10...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fixed a potential UAF Uninitialized Address Fault when the ddgst mismatch occurs. Shivam Kumar identified this vulnerability through vulnerability testing: When the data digest is enabled on an NVMe/TCP connection, and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: IPv6: Clamping the default advertising MSS to avoid GSOBYFRAGS 0xFFFF. When the MTU is large, ip6defaultadvmss may return IPV6MAXPLEN 65535. This is interpreted by TCP as “mssclamp”, allowing the MSS to reach 65535. However,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: gro: Properly validate BIG TCP aggregation criteria When a GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be allowed for plain IPv4 TCP and plain IPv6 TCP, provided there is sufficient...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed corruption of urgent data during multi-segment retransmits. On the normal xmit path, when in urgent mode, we refuse to construct a multi-segment TSO packet. Therefore, each segment has its own urgptr. c / tcpwritexmit ...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: Make sure init calls the spinlocks of the acceptqueue once. When I run the reproduction C program by syz locally, it causes the following issue: pvqspinlock: Lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19;...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: TCP: fixed page frag corruption upon a page fault. Steffen reported a corruption of the TCP stream for HTTP requests served by the Apache web-server, using a CIFS mount-point and the corresponding file’s memory mapping. The root...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: Race conditions between subflow failures and additional subflow creations. We have race conditions similar to those addressed by the previous patch, between subflow failures and additional subflow creations. However, these...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: The possibility of a Use-after-Free condition arises when selecting an endpoint. The functions selectlocaladdress and selectsignaladdress both select an endpoint from a list within the RCU-protected section. However,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, the annotations for data-races around sk-skdataready,writespace have been updated. skmsg and possibly other layers are updating these pointers, while other CPUs may be reading them concurrently. Correspondin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed the range of cmd-req.sg when the PDU length or offset exceeds sgcnt, and then use absurd values for sg-length/offset...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mptcp: handles DDS corruption consistently. The buggy peer implementation can send corrupted DSS options, consistently causing several warnings in the data path. Use DEBUGNET assertions to avoid errors on some builds and to handl...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: validate source addr length I don’t see any checks to ensure that TCPMETRICSATTRSADDRIPV4 is at least 4 bytes long. Also, the policy does not have any entries for this attribute at all similarly, there are no entries...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: Fixed an out-of-bounds condition during the parsing of TCP options. The TCP option parser in synproxy（synproxyparseoptions）could read one byte out of bounds. When the length is 1, the execution flow enters a...