UBUNTU-CVE-2023-53211

In the Linux kernel, the following vulnerability has been resolved: driver core: location: Free struct acpipldinfo pld before return false struct acpipldinfo pld should be freed before the return of allocation failure, to prevent memory leak, add the ACPIFREE to fix it...

UBUNTU-CVE-2022-50326

In the Linux kernel, the following vulnerability has been resolved: media: airspy: fix memory leak in airspy probe The commit ca9dc8d06ab6 "media: airspy: respect the DMA coherency rules" moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing...

UBUNTU-CVE-2022-50294

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbsinitadapter When kfifoalloc failed in lbsinitadapter, cmd buffer is not released. Add free memory to processing error path...

UBUNTU-CVE-2023-53239

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Add check for kzalloc As kzalloc may fail and return NULL pointer, it should be better to check the return value in order to avoid the NULL pointer dereference. Patchwork:...

UBUNTU-CVE-2022-50271

In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: Use kvmalloc/kvfree for larger packets. When copying a large file over sftp over vsock, data size is usually 32kB, and kmalloc seems to fail to try to allocate 32 32kB regions. vhost-5837: page allocation failure:...

UBUNTU-CVE-2022-50308

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devmkcalloc As the devmkcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference...

UBUNTU-CVE-2023-53199

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: clean up skbs if ath9khifusbrxstream fails Syzkaller detected a memory leak of skbs in ath9khifusbrxstream. While processing skbs in ath9khifusbrxstream, the already allocated skbs in skbpool are not freed if...

CVE-2022-50338

The CVE-2022-50338 entry concerns a Linux kernel binder UAF in a race between binder_update_page_range() and munmap() that can access alloc->vma after it is freed. Affected component: kernel Binder in Linux kernel (stable branches 5.4 and 5.10). Root cause: improper locking around mmap/vma han...

CVE-2022-50335 9p: set req refcount to zero to avoid uninitialized usage

In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized usage When a new request is allocated, the refcount will be zero if it is reused, but if the request is newly allocated from slab, it is not fully initialized before being added...

CVE-2022-50326 media: airspy: fix memory leak in airspy probe

In the Linux kernel, the following vulnerability has been resolved: media: airspy: fix memory leak in airspy probe The commit ca9dc8d06ab6 "media: airspy: respect the DMA coherency rules" moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to insufficient bounds checking on the authorization header. An attacker can cause excessive memory allocation by sending specially crafted requests, potentially leading to servic...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to insufficient bounds checking on the authorization header. An attacker can cause excessive memory allocation by sending specially crafted requests, potentially leading to servic...

CVE-2023-53253 HID: nvidia-shield: Reference hid_device devm allocation of input_dev name

In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hiddevice devm allocation of inputdev name Use hiddevice for devm allocation of the inputdev name to avoid a use-after-free. inputunregisterdevice would trigger devres cleanup of all resources...

CVE-2023-53253

CVE-2023-53253 affects the Linux kernel HID path for nvidia-shield. The underlying issue is a use-after-free caused by freeing the input_dev name during input_dev unregister, when the name is freed by devres cleanup via input_unregister_device. The mitigation described in the public records is to...

CVE-2023-53253 HID: nvidia-shield: Reference hid_device devm allocation of input_dev name

In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hiddevice devm allocation of inputdev name Use hiddevice for devm allocation of the inputdev name to avoid a use-after-free. inputunregisterdevice would trigger devres cleanup of all resources...

CVE-2023-53244 media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

CVE-2023-53244 media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

CVE-2023-53243 btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile

In the Linux kernel, the following vulnerability has been resolved: btrfs: add handling for RAID1C23/DUP to btrfsreduceallocprofile Callers of btrfsreduceallocprofile expect it to return exactly one allocation profile flag, and failing to do so may ultimately result in a WARNON and remount-ro whe...

CVE-2023-53243 btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile

In the Linux kernel, the following vulnerability has been resolved: btrfs: add handling for RAID1C23/DUP to btrfsreduceallocprofile Callers of btrfsreduceallocprofile expect it to return exactly one allocation profile flag, and failing to do so may ultimately result in a WARNON and remount-ro whe...

CVE-2022-50294 wifi: libertas: fix memory leak in lbs_init_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbsinitadapter When kfifoalloc failed in lbsinitadapter, cmd buffer is not released. Add free memory to processing error path...