Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Revised the handling of clock reordering and power management in the probe function. The initialization sequence in usbhsprobe was reorganized to enable runtime PM before accessing registers. This prevents...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: A NULL pointer dereference issue was fixed in hnsrocemapmrsg. The function ibmapmrsg allows ULPs to specify NULL as the sgoffset argument. The driver needs to check whether the argument is a NULL pointer before...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport init-annotated hvinitclocksource EXPORTSYMBOL and init are a poor combination, as the .init.text section is freed after initialization. As a result, modules cannot use symbols annotated with init...

Astra Linux – Vulnerability in SOX

There is a heap-based buffer overflow vulnerability in the sphere.c startread function of the Sound Exchange libsox 14.4.2 version and the main commit 42b3557e. A specially crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in TIF format

A stack overflow was discovered in the TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service DoS attack through a specially crafted TIFF file parsed by the “tiffsplit” or “tiffcrop” utilities...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/ucma: Protects mc during concurrent multicast leaves. The commit mentioned in the “Fixes” section has been partially reverted to ensure that the allocation and erasure of multicast structures are locked. BUG: KASAN:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Fix idafree call while not allocated In the rprocalloc function, when an error occurs, the putdevice&rproc-dev call is made, leading to the invocation of the rproctyperelease function. An error can occur before...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - spi: rockchip: Fixed improper handling of runtime PM/system PM operations. The commit e882575efc77 “spi: rockchip: Suspend and resume the bus during NOIRQSYSTEMSLEEPPM ops” no longer respects the runtime PM status and simply...

Astra Linux – Vulnerability in Linux 5.10

A issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in the iosqpollwaitsq function in fs/iouring.c allows an attacker to crash the kernel, resulting in a denial of service. The finishwait function can be bypassed. An attack can occur in some situations by forkning ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phonet: fixed the rtmphonetnotify function’s skb allocation. The fillroute function stores three components in the skb: - struct rtmsg - RTADST u8 - RTAOIF u32 Therefore, rtmphonetnotify should use: NLMSGALIGNsizeofstruct rtmsg...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: remoteproc: sysmon: fix memory leak in qcomaddsysmonsubdev The kfree function should be called when ofirqgetbyname fails or devmrequestthreadedirq fails in qcomaddsysmonsubdev. Otherwise, a memory leak will occur; therefore, addi...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix of node refcount leak in tcpciregisterport I encountered the following issue while performing the device mt6370-tcpc load test with CONFIGOFUNITTEST and CONFIGOFDYNAMIC enabled: ERROR: Memory leak; the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: binder: A check for offset alignment was added in bindergetobject. Commit 6d98eb95b450 “binder: avoid potential data leakage when copying txn” introduced changes to the way binder objects are copied. As a result, the offset...

Astra Linux – Vulnerability in ffmpeg

A denial-of-service vulnerability exists in FFmpeg 4.2 due to a memory leak in the configinput function in the afacrossover.c file...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mISDN: fixed a possible use-after-free in HFCcleanup The remove path of this module calls deltimer. However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running aft...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: s390/dasd: fixed an issue where error recovery led to data corruption on ESE devices. Extent Space Efficient ESE or thin-provisioned volumes need to be formatted on demand during normal IO processing. The dasdeseneedsformat...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handling of actinetdevs allocation failures The kmallocarray function in nfpfllagdowork will return null if physical memory runs out. As a result, if we dereference actinetdevs, null pointer dereferencing bugs may...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: sbs-battery: Fixed a use-after-free in powersupplychanged. By using the devm variant to request the IRQ before using the devm variant to allocate/register the powersupply handle, it is possible that the powersupply...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty-discdata only in the successful path. Setting tty-discdata before opening the NCI device means that we need to clean up the state in error paths. This also opens a short window during operation—if the devi...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: irqchip/irq-riscv-imsic-early: Fixed the fwnode leak that occurred when the state setup failed. imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns...