Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050-core: fix pmruntime error handling The return value of pmruntimegetsync is not checked, allowing the driver to access hardware that may fail to resume. The device usage count is also unconditionally incremented...

Astra Linux – Vulnerability in pillow

Packages with version numbers 5.2.0 and earlier, as well as 8.3.2, are vulnerable to Regular Expression Denial of Service ReDoS attacks through the getrgb function...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “landlock”: Fixed the “dparent” walk. The WARNONONCE function in “collectdomainaccesses” can be triggered when trying to link a root mount point. This does not actually work in practice because this directory is already mounted,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: NFSD: Fixed a potential use-after-free in nfsdfileput The nfsdfileputnoref function can free the @nf object; therefore, do not dereference @nf immediately after returning from nfsdfileputnoref...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: fixed the potential integer overflow that could occur when shifting an int. The left shift of the 32-bit integer constant 1 is evaluated using 32-bit arithmetic, and then passed as a 64-bit function argument. In cas...

Astra Linux – Vulnerability in golang-gopkg-yaml.v3

A issue with the Un Marshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input...

Astra Linux – Vulnerability in binutils

A issue was discovered in the Binary File Descriptor BFD library also known as libbfd, as distributed in GNU Binutils 2.31. An invalid memory access exists in the bfdstabsectionfindnearestline function in syms.c. Attackers could exploit this vulnerability to cause a denial of service application...

Astra Linux – Vulnerability in ncurses

ncurses 6.3 before patch 20220416 contains a buffer overflow vulnerability and segmentation violation in the convertstrings function in the tinfo/readentry.c file of the terminfo library...

Astra Linux – Vulnerability in freeglut

It was discovered that freeglut 3.4.0 contains a memory leak due to a memory leak involving the menuEntry variable within the glutAddSubMenu function...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: geneve: The “gate GRO hint” in genevegrocomplete is handled via geneveskgrohintoff. genevegroreceive reads the GRO hint using geneveskgrohintoff, but only when the socket has the IFLAGENEVEGROHINT flag enabled gs-grohint...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/setmemory: Avoid spinlock recursion in changepageattr The commit 1f9ad21c3b38 “powerpc/mm: Implement setmemory routines” included a spinlock call in changepageattr in order to safely perform the three-step operations...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: vhostvdpa: The irqbypassunregisterproducer function must correctly assign the token. Previously, we used irqbypassunregisterproducer in vhostvdpasetupvqirq, which was problematic because we had no way of knowing whether the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: vt: Clear the selection before changing the font. When changing the console font using ioctlKDFONTOP, the new font size may be larger than the previous one. As a result, a previously selected text may now be displayed outside the...

Astra Linux – Vulnerability in libtasn1-6

GNU Libtasn1 before version 4.19.0 has a array size check for the ETYPEOK field that can lead to errors. This issue affects the asn1encodesimpleder function...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: UDP: Fixed memory accounting leak. Matt Dowling reported a strange UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spikes to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: TCP: fixed page frag corruption upon a page fault. Steffen reported a corruption of the TCP stream for HTTP requests served by the Apache web-server, using a CIFS mount-point and the corresponding file’s memory mapping. The root...

Astra Linux – Vulnerability in GhostScript

Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in the sampleddatasample function called from sampleddatacontinue and interp...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drivers: dio: A possible memory leak has been fixed in dioinit. If deviceregister returns an error, the dev object and its associated name need to be freed. Add a release function, and then call putdevice in the error handling...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Do not free the qgroup space unless specified. Boris noticed during his simple quota testing that there was a leak caused by Sweet Tea’s change to the subvol create function, which would stop a transaction commit. This...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: Fixed duplicate HDLC netdev allocations. The ixp4xxhssprobe function allocates two HDLC netdevs. The first one is stored in the ndev variable, initialized, and registered with the registerhdlcdevice function. The...