Astra Linux – Vulnerability in Linux, Linux 5.10

A heap-based buffer overflow flaw was discovered in the way the legacyparseparam function in the Linux kernel’s Filesystem Context functionality verifies the length of the supplied parameters. A non-privileged user if non-privileged user namespaces are enabled, otherwise requiring CAPSYSADMIN...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A stack overflow flaw was discovered in the Linux kernel’s SYSCTL subsystem regarding how a user modifies certain kernel parameters and variables. This flaw allows a local user to crash the system or potentially escalate their privileges on the system...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the bpf and arm64 implementations, the value of prog-jitedlen was cleared along with prog-jited. The syzbot reported an attempt to perform an illegal copytouser operation from the bpfproggetinfobyfd function 1. There has been ...

Astra Linux – Vulnerability in Linux 5.10

A vulnerability was discovered in the Linux kernel’s blockinvalidatepage function in the fs/buffer.c file of the filesystem. A missing sanity check may allow a local attacker with user privileges to cause a denial of service DOS issue...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A memory write vulnerability that is outside the bounds of the system’s protection was discovered in the Linux kernel’s Kid-friendly Wired Controller driver. This vulnerability allows a local user to crash the system or potentially escalate their privileges. The issue lies in the bigbenprobe...

Astra Linux – Vulnerability in Linux 5.10

A double-free flaw was discovered in the Linux kernel’s TUN/TAP device driver functionality, particularly in how a user registers the device when the registernetdevice function fails with the NETDEVREGISTER notifier. This flaw allows a local user to crash the system or potentially escalate their...

Astra Linux – Vulnerability in Chromium

The use of the after-free operation in the Webstore API in Google Chrome before version 98.0.4758.102 allowed attackers to exploit heap corruption by using a crafted HTML page. This was possible if an attacker convinced a user to install a malicious extension and compelled the user to perform...

Astra Linux – Vulnerability in Linux 5.10

A flaw was discovered in the way the “flags” member of the new pipe buffer structure lacked proper initialization in the copypagetoiterpipe and pushpipe functions of the Linux kernel. As a result, these members could contain stale values. An unprivileged local user could exploit this flaw to writ...

Astra Linux – Vulnerability in libvirt

A flaw was discovered in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver-nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to prevent another thread from concurrently modifying the driver-nwfilters object...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Cast in Google Chrome before version 99.0.4844.51 allowed attackers to convince users to install a malicious extension and induce specific user interactions, thereby potentially exploiting heap corruption through a crafted Chrome Extension...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

An incorrect TLB flush issue was detected in the Linux kernel’s GPU i915 kernel driver. This flaw may lead to random memory corruption or data leaks. It could also allow a local user to crash the system or escalate their privileges on the system...

Astra Linux – Vulnerability in Linux 5.15

A NULL pointer dereference flaw was discovered in the Linux kernel’s drivers/gpu/drm/msm/msmgemsubmit.c code, specifically in the submitlookupcmds function. This flaw occurs because there is no check on the return value of kmalloc. This issue allows a local user to crash the system...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In multiple functions of iouring.c, there is a possibility of kernel memory corruption due to improper locking. This could lead to a local escalation of privileges in the kernel, as execution privileges are required. User interaction is not necessary for exploiting this vulnerability...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Side Panel Search in Google Chrome before version 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption through those interactions. Chromium security severity: High...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2021.07 and earlier is affected by a stack-based buffer overflow vulnerability that may lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction—that is, the victim must open a specially crafted file...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow vulnerability in PDF files in Google Chrome prior to version 118.0.5993.70 allowed a remote attacker who convinced a user to perform certain user interactions to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk.Authenticated users can use string matching commands such as SCAN or KEYS with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% of CPU resources. This issue has been fixed in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A use-after-free flaw was discovered in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 “coredump: Use the vma snapshot in fillfilesnote” is not applied yet, then the kernel may be affected...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A memory corruption flaw was discovered in the Linux kernel’s Human Interface Device HID subsystem, regarding the way a malicious USB device is inserted by a user. This flaw allows a local user to crash the system or potentially escalate their privileges on the system...