Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdxraid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdxraid1 thread were not stop, Even if the associated resources have been released. it wi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use after free on unload A system crash is observed due to a stack trace warning related to the use after free operation. There are two signals that can cause dpcthread to terminate: the UNLOADING flag and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Vulnerability: Out-of-bounds write during RX overflow Problem: The stm32rxdone function appends each received CEC byte to the rxmsg.msg array using rxmsg.len as the write index. This index is incremented on every RXBR...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: m68k: Fixed the race condition involving spinlocks in kernel thread creation. Context switching ensures that the correct lock owner is retained during the transition between “prev” and “next” tasks. This relies on interrupts...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix showrcutaskstracegpkthread buffer overflow There is a possibility of buffer overflow in showrcutaskstracegpkthread if counters, passed to sprintf are huge. Counter numbers, needed for this are unrealistically high,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: wwan: t7xx: Fixed the FSM command timeout issue When the driver processes the internal state change command, it uses an asynchronous thread to handle the command operation. If the main thread detects that the task has tim...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: In devcom, fix for error flow in mlx5devcomregisterdevice. In the event of a failure in devcom allocation, mlx5 always frees the private data. However, this private data might have been allocated by a different thread...

Astra Linux – vulnerability in Firefox

The absence of thread synchronization primitives might have resulted in a data race involving members of the PlaybackParams structure. This vulnerability affects Firefox 133 and Thunderbird 133...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: refscale: Fix uninitalized use of waitqueueheadt Running the refscale test occasionally crashes the kernel with the following error: 8569.952896 BUG: unable to handle page fault for address: ffffffffffffffe8 8569.952900 PF:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: a fix was made to avoid a Use-After-Free issue in f2fswriteendio. According to syzbot, a use-after-free issue occurred in f2fswriteendio. This issue is caused by the following race condition: Loop device Unmount Worker...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB Server before version 10.7 is vulnerable to Denial of Service attacks. In the file extra/mariabackup/dscompress.cc, when an error occurs pthreadcreate returns a non-zero value during the execution of the createworkerthreads method, the held lock is not released properly. This allows local...

Astra Linux – vulnerability in binutils

An issue was discovered in elflinkinputbfd within elflink.c in the Binary File Descriptor BFD library also known as libbfd, as included in GNU Binutils 2.31. There is a NULL pointer dereference in elflinkinputbfd when it is used to locate STTTLS symbols that lack any TLS section. A specially...

Astra Linux – Vulnerability in jsoup

jsoup is a Java library for working with HTML. Users of jsoup versions prior to 1.14.2 who parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user-supplied input, an attacker may provide content that causes the parser to become stuck loop indefinitely until...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: hisilicon: Added multi-thread support for DMA channels. When a DMA channel is obtained and tried to be used across multiple threads, it can lead to errors and cause the system to hang. bash % echo 100...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: Add check for kcalloc failure in parsethreadgroups Since kcalloc may fail, verify its return value to prevent a NULL pointer dereference when passing it to ofpropertyreadu32array...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix a deadlock in r5lexitlog Commit b13015af94cf “md/raid5-cache: Clear conf-log after finishing work” introduces a new issue: // caller hold reconfigmutex r5lexitlog flushwork&log-disablewritebackwork...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: The gatemustwaitwritabilitycheckonptepresent function requires a writability check on the ptepresent value. The userfaultfdmustwait and userfaultfdhugemustwait functions read the PTE without acquiring the page table...

Astra Linux – Vulnerability in RustC

In the standard library of Rust before version 1.19.0, there is a synchronization issue with the MutexGuard object. MutexGuards can be used across threads of any type, which can lead to memory safety issues due to race conditions...

Astra Linux – vulnerability in Firefox

Under unusual circumstances, a single thread may survive beyond the end of its manager’s lifetime during shutdown. This could result in a use-after-free condition that may lead to a crash exploitable by attackers. This vulnerability affects Firefox versions prior to 98...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Commit 66a834d09293 “scsi: core: Fix error handling of scsihostalloc” changed the allocation logic to call putdevice to perform host cleanup, assuming that...