Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: can: mcbausb: fixed a memory leak in mcbausb Syzbot reported a memory leak in the SocketCAN driver for the Microchip CAN BUS Analyzer Tool. The problem was in the unfreed usbcoherent component. In mcbausbstart, 20 coherent...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: xhci-plat: Fix for crashes when suspending if remote wake is enabled Crashes occurred on the i.mx8qm platform when suspending if remote wakeup was enabled. Internal error: Synchronous external abort: 96000210 1 PREEMPT SMP...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate control request size The function faudiocomplete copies req-length bytes into a 4-byte stack variable: c u32 data = 0; memcpy&data, req-buf, req-length; req-length is derived from the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in ‘usbgetbosdescriptor’ The BOS descriptor defines a root descriptor and serves as the base descriptor for accessing a family of related descriptors. The function usbgetbosdescriptor encounters a...

Astra Linux – Vulnerability in Qemu

A out-of-bounds write flaw was discovered in the UAS USB-attached SCSI device emulation in QEMU in versions prior to 6.2.0-rc0. The device uses the guest-provided stream number without proper checking, which can lead to out-of-bounds access to the UASDevice-data3 and UASDevice-status3 fields. A...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: xhci-mtk: Fixed an issue where shared HCD resources were leaked when attempting to set the wake-up IRQ. The issue occurred because it was not possible to set @sharedhcd to NULL before reducing the usage count using usbputhcd...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it expects before binding to it. If a malicious device does not have the...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the USB redirector device usb-redir of QEMU. Small USB packets are combined into a single, large transfer request, in order to reduce overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array VLA on th...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8712: fixed an issue with uninit-value in usbread8 and related functions. When r8712usbctrlvendorreq returns a negative value, the “data” stored in usbread8,16,32 will not be initialized. Bug: KMSAN: uninit-value i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the usbmon module of the Linux kernel, the files drivers/usb/mon/monbin.c before version 5.19.15 and versions 6.x before 6.0.1 allow a user-space client to corrupt the internal memory of the monitor...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check that the endpoint is valid before dereferencing it. When the host controller is not responding, all URBs queued to all endpoints need to be terminated. This can cause a kernel panic if we attempt to dereference a...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux kernel’s driver for ASIX AX88179178A-based USB 2.0/3.0 Gigabit Ethernet devices. The vulnerability involves multiple out-of-bounds reads and possible out-of-bounds writes...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb:typec:tipd: The WARNON message in tps6598xblockread has been removed. Calling tps6598xblockread with a parameter length that exceeds the allowed limit can be handled by simply returning an error. There is no need to cause...

Astra Linux – Vulnerability in Wireshark

A crash occurred in the USB HID protocol dissector, and possibly in other dissectors in Wireshark versions 3.4.0, 3.2.0 to 3.2.8. This issue allows for denial of service through packet injection or with crafted capture files...

Astra Linux – Vulnerability in Wireshark

The USB HID protocol dissector infinite loop in Wireshark versions 4.6.0 to 4.6.4, and 4.4.0 to 4.4.14 allows for denial of service...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: rt2x00: Fixed memory leak when handling survey data When removing a rt2x00 device, the associated channel surveys are not freed, resulting in a memory leak that can be observed using kmemleak. The affected object is:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath9k: hifusb: Fixed a memory leak related to remainskbs. The hifdev-remainskb is allocated and used exclusively in ath9khifusbrxstream. It is implied that an allocated remainskb is processed and subsequently freed in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly dropping the USB interface reference when disconnected When the device is disconnected from the driver, there is a “dangling” reference count on the USB interface, which was acquired during the probe callback...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: properly checking the endpoint type Syzbot reported a warning in usbsubmiturb, which is caused by an incorrect endpoint type. We should check that the endpoint actually exists to prevent this warning. Pipes found ar...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A memory corruption flaw was discovered in the Linux kernel’s Human Interface Device HID subsystem, regarding the way a malicious USB device is inserted by a user. This flaw allows a local user to crash the system or potentially escalate their privileges on the system...