ABB Improper Restriction of Operations Within the Bounds of a Memory Buffer in Wind River VxWorks (CVE-2019-12261)

Wind River is the provider of a real time operating system called VxWorks which is used in the embedded software of the PM 877 Controller. Wind River has announced security vulnerabilities in the VxWorks TCP/IP stack IPnet and management of memory block size Bad Alloc. The controller PM 877 is...

ABB Improper Neutralization of Argument Delimiters in a Command in Wind River VxWorks (CVE-2019-12264)

Wind River is the provider of a real time operating system called VxWorks which is used in the embedded software of the PM 877 Controller. Wind River has announced security vulnerabilities in the VxWorks TCP/IP stack IPnet and management of memory block size Bad Alloc. The controller PM 877 is...

ABB Heap-Based Buffer Overflow in Wind River VxWorks (CVE-2019-12257)

Wind River is the provider of a real time operating system called VxWorks which is used in the embedded software of the PM 877 Controller. Wind River has announced security vulnerabilities in the VxWorks TCP/IP stack IPnet and management of memory block size Bad Alloc. The controller PM 877 is...

ABB Improper Neutralization of Argument Delimiters in a Command in Wind River VxWorks (CVE-2019-12258)

Wind River is the provider of a real time operating system called VxWorks which is used in the embedded software of the PM 877 Controller. Wind River has announced security vulnerabilities in the VxWorks TCP/IP stack IPnet and management of memory block size Bad Alloc. The controller PM 877 is...

kernel: bpf, sockmap: Fix more uncharged while msg has more_data

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

kernel: tcp: Fix a data-race around sysctl_tcp_probe_interval.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctltcpprobeinterval. While reading sysctltcpprobeinterval, it can be changed concurrently. Thus, we need to add READONCE to its reader...

kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time

A NULL pointer dereference issue was discovered in the Linux kernel. This issue occurs in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could potentially crash the system, causing a denial of service...

kernel: mptcp: use proper req destructor for IPv6

A flaw was discovered in the Linux kernel’s Multipath TCP MPTCP implementation where the wrong destructor function was used for IPv6 subflow request sockets. Previously, even when handling IPv6 MPTCP subflows, only the IPv4 request socket destructor was invoked, leaving IPv6-specific fields...

kernel: tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Fix a data-race around sysctltcpfwmarkaccept. While reading sysctltcpfwmarkaccept, it can be changed concurrently. Thus, we need to add READONCE to its reader...

kernel: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()

A flaw was found in the iSCSI TCP component in the Linux kernel. A race condition between releasing a socket and accessing it via sysfs can lead to a NULL pointer dereference when calling getpeername. This issue can cause a crash and result in a denial of service...

kernel: tcp: Fix data-races around sysctl_tcp_migrate_req.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcpmigratereq. While reading sysctltcpmigratereq, it can be changed concurrently. Thus, we need to add READONCE to its readers...

kernel: tcp: Fix data-races around sysctl_tcp_recovery.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcprecovery. While reading sysctltcprecovery, it can be changed concurrently. Thus, we need to add READONCE to its readers...

kernel: tcp: Fix data-races around sysctl_tcp_fastopen.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcpfastopen. While reading sysctltcpfastopen, it can be changed concurrently. Thus, we need to add READONCE to its readers...

kernel: nvmet-tcp: add bounds check on Transfer Tag

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmettcphandleh2cdatapdu, add a bounds check to avoid out-of-bounds access...

kernel: tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctltcpthinlineartimeouts. While reading sysctltcpthinlineartimeouts, it can be changed concurrently. Thus, we need to add READONCE to its reader...

kernel: tcp: Fix a data-race around sysctl_tcp_notsent_lowat.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctltcpnotsentlowat. While reading sysctltcpnotsentlowat, it can be changed concurrently. Thus, we need to add READONCE to its reader...

kernel: tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctltcpmtuprobefloor. While reading sysctltcpmtuprobefloor, it can be changed concurrently. Thus, we need to add READONCE to its reader...

kernel: tcp: Fix a data-race around sysctl_tcp_ecn_fallback.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctltcpecnfallback. While reading sysctltcpecnfallback, it can be changed concurrently. Thus, we need to add READONCE to its reader...

kernel: bpf, sockmap: Fix double uncharge the mem of sk_msg

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of skmsg If tcpbpfsendmsg is running during a tear down operation, psock may be freed. tcpbpfsendmsg tcpbpfsendverdict skmsgreturn tcpbpfsendmsgredir unlikely!psock skmsgfree The mem of m...

kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt

A vulnerability was found in the tcp subsystem in the Linux Kernel, due to a data race around icsk-icskafops. This issue could allow an attacker to leak internal kernel information...