Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not flush non-uploaded STAs. If the STA state is pre-moved to AUTHORIZED such as in IBSS scenarios, and the insertion attempt fails, the station is freed. In this case, the driver never knew about the station;...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: keys: Fixed UAF in keyput Once a key’s reference count is reduced to 0, the garbage collector thread may destroy it at any time. Therefore, keyput is no longer allowed to access the key after that point. The only action that keyp...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Added sanity checks for the validity of rdev. There is a possibility that callbacks for ulpirqstop and ulpirqstart will be called when the device is in a detached state. This could lead to a crash due to NULL pointer...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: do not attempt to communicate with a dead firmware. This fix addresses the issue where the firmware might be inactive. The changes include: badstate = 0 WARNING: CPU: 10 PID: 702 at...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm: abort vmamodify on merge out of memory failure The remainder of vmamodify relies on the vmg state remaining pristine after a merge attempt. Normally, this assumption holds true. However, in one edge-case scenario where a merg...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: sched: A potential NULL pointer dereferencing issue exists in the GRED scheduler. If kzalloc in gredinit returns a NULL pointer, the code follows the error handling path and invokes greddestroy. This, in turn, calls gredoffload. ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Added a bounds check for the durable handle context. A missing bounds check was added for the durable handle context...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iio: backend: make sure to NULL terminate the stack buffer Make sure to NULL terminate the buffer in iiobackend DebugfsWriteReg before passing it to sscanf. It is a stack variable, so we should not assume that it will be...

Astra Linux – Vulnerability in edk2

EDK2 contains a vulnerability in the BIOS, where a user can cause an Integer Overflow or Wrap-around error through network means. Successful exploitation of this vulnerability may lead to a denial of service...

Astra Linux – Vulnerability in Augeas

A vulnerability has been discovered in Hercules Augeas 1.14.1 and is classified as problematic. This vulnerability affects the recaseexpand function of the src/fa.c file. Manipulation of the re argument leads to a null pointer dereference. Local attacks are required to exploit this vulnerability...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A flaw was discovered in libsoup. The package is vulnerable to a heap buffer over-read issue when scanning content using the skipinsightwhitespace function. Libsoup clients may read one byte beyond the bounds of the memory area in response to a malicious HTTP response from an HTTP server...

Astra Linux – Vulnerability in Firefox

A carefully crafted URL containing specific Unicode characters could conceal the true origin of the page, leading to a potential spoofing attack. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9...

Astra Linux – Vulnerability in Chromium

The use of Site Isolation in Google Chrome before version 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A flaw was discovered in libsoup. The libsoup appendparamquoted function may contain an overflow bug, which can lead to a buffer under-read...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A flaw was discovered in libsoup, where soupauthdigestauthenticate is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A use-after-free vulnerability was discovered in libsoup, within the soupmessageheadersgetcontentdisposition function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCKRCUFREE The Bind lookup operation is executed under RCU; therefore, ensure that a socket does not disappear during the middle of a lookup operation...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Added a check for the return value of spiimxsetupxfer. The function pointers spiimx-rx and spiimx-tx can be NULL when spiimxsetupxfer returns an error, and NULL pointers should not be dereferenced. It is not possibl...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fixed deadlocks related to PM in MS IOCTLs. Prevent runtime resume/suspend while MS IOCTLs are in progress. A failed suspend will invoke ivpumscleanup, which will attempt to acquire filepriv-mslock, a lock that is...