Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Fixed a potential deadlock in miread. A mutex lock was used in nilockdir, along with another subclass of mutex...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not pass a stopped vif to the driver in .gettxpower. Avoid potentially crashing the driver due to uninitialized private data...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: HugeTLB pages are skipped for unusevma. I encountered a “bad pud” error and lost 1GB of HugeTLB when calling swapoff. The problem can be reproduced using the following steps: 1. Allocate an anonymous 1GB HugeTLB and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb3: A missing lock occurs when picking the channel. Coverity has identified a point where we should have held the channel lock when accessing the ses channel index. Address-Coverity: 1582039 “Data race condition MISSINGLOCK”...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dyndbg: fixed an old BUGON in the control parser. Fixed a BUGON from 2009. Even if it seems “unreachable” I haven’t actually checked, let’s ensure it by removing it and instead using prerr and returning -EINVAL...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: lgdt3306a: A check against a null-pointer-def was added. The driver should check whether the client provides the platformdata. The following log reveals this issue: 29.610324 BUG: KASAN: nullptrderef in kmemdup+0x30/0x40...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: A infinite loop occurs when replaying fastcommit. When performing a fastcommit replay, an infinite loop may occur due to an uninitialized extentstatus structure. The ext4extdetermineinserthole function does not detect this...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: use !CONFIG64BIT to relax huge page alignment on 32-bit machines Yves-Alexis Perez reported a commit 4ef9ad19e176 “mm: hugememory: don’t force huge page alignment on 32-bit machines” which did not work for x8632 1...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Closures: Change BUGON to WARNON If a BUGON function is actually executed, it shouldn’t be considered a real BUG. For reference, this issue has occurred once during the continuous integration process. We will need more informatio...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since the commit c49cfa917025 “USB: serial: use generic method if no alternative is provided in the USB serial layer”, the USB serial core calls the generic resume implementation when the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: fsl-asoc-card: Set priv-pdev before using it The priv-pdev pointer was set after it was used in fslasoccardaudmuxinit. This assignment should be moved to the beginning of the probe function, so that sub-functions can...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4: A memory leak has been fixed in nfs4setsecuritylabel. We encounter a memory leak whenever we set a security xattr, which involves accessing nfsfattr and nfs4label...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Reverted the behavior where “Info: mapping multiple BARs. Your kernel is fine.” was avoided. Undo the modifications made in commit d410ee5109a1 “ACPICA: avoid “Info: mapping multiple BARs. Your kernel is fine.””. The...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm – Check nssids before accessing the ssids. In some versions of cfg80211, the ssids pointed to might be a valid value even when nssids is 0. Accessing the pointer in this case could lead to an out-of-bound acces...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: The exit callback is optional. The exit callback is not required and should not be called without first checking a valid pointer. Additionally, we must clear the freqtable pointer even if the exit callback is not present...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net: sched subsystem, there is a issue with schmultiq. A possible out-of-bounds write may occur during the multiqtune function. The q-bands fields will be assigned to qopt-bands to execute subsequent code logic after...

Astra Linux – Vulnerability in Ruby 3.1

REXML is an XML toolkit for Ruby. The REXML gem before version 3.3.2 had some DoS vulnerabilities when parsing XML that contained many special characters, such as whitespace characters, , , and . The REXML gem versions 3.3.3 or later include patches to fix these vulnerabilities...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fixed the issue where reading ucode could lead to out-of-bounds access warnings...

Astra Linux – Vulnerability in mpg123

A out-of-bounds write flaw was discovered in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write beyond the end of a heap-located buffer. As a result, heap corruption may occur, and arbitrary code execution is not prevented. The complexity required to exploit this fla...

Astra Linux – Vulnerability in Firefox and Thunderbird

In some cases, video frames may have been leaked between their origins. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...