UBUNTU-CVE-2022-50287

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: fix a memory leak in generatelfpdataptrs When size != 0 || ptrs-lvds entries != 3, the program tries to free the ptrs. However, the ptrs is not created by calling kzmalloc, but is obtained by pointer offset...

UBUNTU-CVE-2022-50329

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfqexiticqbfqq Commit 64dc8c732f5c "block, bfq: fix possible uaf for 'bfqq-bic'" will access 'bic-bfqq' in bicsetbfqq, however, bfqexiticqbfqq can free bfqq first, and then call bicsetbfqq, which...

UBUNTU-CVE-2022-50273

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on destination blkaddr during recovery As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=216456 loop5: detected capacity change from 0 to 131072 F2FS-fs loop5:...

CVE-2022-50329

CVE-2022-50329 affects the Linux kernel’s block/bfq subsystem. The root cause was a use-after-free: bfqq could be freed in bfq_exit_icq_bfqq() and then used in bic_set_bfqq(), leading to UAF. The fix reorders operations by moving bfq_exit_bfqq() behind bic_set_bfqq(), preventing the invalid access.

CVE-2022-50329 block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfqexiticqbfqq Commit 64dc8c732f5c "block, bfq: fix possible uaf for 'bfqq-bic'" will access 'bic-bfqq' in bicsetbfqq, however, bfqexiticqbfqq can free bfqq first, and then call bicsetbfqq, which...

CVE-2022-50329 block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfqexiticqbfqq Commit 64dc8c732f5c "block, bfq: fix possible uaf for 'bfqq-bic'" will access 'bic-bfqq' in bicsetbfqq, however, bfqexiticqbfqq can free bfqq first, and then call bicsetbfqq, which...

CVE-2022-50314

The CVE-2022-50314 issue affects the Linux kernel nbd subsystem. When a signal interrupts nbd_start_device_ioctl() while waiting for inflight I/Os to complete, a hung task could occur. The fix clears the queue (not just shutdown) on signal interruption to nbd_start_device_ioctl(), mitigating the ...

CVE-2022-50314 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()

In the Linux kernel, the following vulnerability has been resolved: nbd: Fix hung when signal interrupts nbdstartdeviceioctl syzbot reported hung task 1. The following program is a simplified version of the reproducer: int mainvoid int sv2, fd; if socketpairAFUNIX, SOCKSTREAM, 0, sv recvthreads =...

CVE-2022-50314 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()

In the Linux kernel, the following vulnerability has been resolved: nbd: Fix hung when signal interrupts nbdstartdeviceioctl syzbot reported hung task 1. The following program is a simplified version of the reproducer: int mainvoid int sv2, fd; if socketpairAFUNIX, SOCKSTREAM, 0, sv recvthreads =...

CVE-2022-50299 md: Replace snprintf with scnprintf

In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf returns the number of characters generated from...

CVE-2022-50299 md: Replace snprintf with scnprintf

In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf returns the number of characters generated from...

CVE-2022-50299

CVE-2022-50299 is a Linux kernel issue in the md (multiple device) module where snprintf() could wrap around when the total length of the block device names with slashes exceeds 200, leading to incorrect buffer sizing. The vulnerability arises from using snprintf; the fix is to replace snprintf w...

CVE-2023-53230 smb: client: fix warning in cifs_smb3_do_mount()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning in cifssmb3domount This fixes the following warning reported by kernel test robot fs/smb/client/cifsfs.c:982 cifssmb3domount warn: possible memory leak of 'cifssb'...

CVE-2023-53222 jfs: jfs_dmap: Validate db_l2nbperpage while mounting

In the Linux kernel, the following vulnerability has been resolved: jfs: jfsdmap: Validate dbl2nbperpage while mounting In jfsdmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree. dbl2nbperpage, which is the log2 number of blocks per page, is passed as an argument to...

CVE-2023-53222 jfs: jfs_dmap: Validate db_l2nbperpage while mounting

In the Linux kernel, the following vulnerability has been resolved: jfs: jfsdmap: Validate dbl2nbperpage while mounting In jfsdmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree. dbl2nbperpage, which is the log2 number of blocks per page, is passed as an argument to...

CVE-2023-53222 jfs: jfs_dmap: Validate db_l2nbperpage while mounting

In the Linux kernel, the following vulnerability has been resolved: jfs: jfsdmap: Validate dbl2nbperpage while mounting In jfsdmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree. dbl2nbperpage, which is the log2 number of blocks per page, is passed as an argument to...

CVE-2023-53207 ublk: fail to recover device if queue setup is interrupted

In the Linux kernel, the following vulnerability has been resolved: ublk: fail to recover device if queue setup is interrupted In ublkctrlendrecovery, if waitforcompletioninterruptible is interrupted by signal, queues aren't setup successfully yet, so we have to fail UBLKCMDENDUSERRECOVERY,...

CVE-2023-53207

CVE-2023-53207 applies to the Linux kernel ublk subsystem. The issue arises in ublk_ctrl_end_recovery: if wait_for_completion_interruptible() is interrupted by a signal, queues aren’t yet fully set up, so the kernel must fail UBLK_CMD_END_USER_RECOVERY to avoid a kernel oops. The CVSS 3.1 data in...

CVE-2023-53200

CVE-2023-53200 (Linux kernel) : The vulnerability is in netfilter: x_tables where a percpu counter block allocated for a new netns is leaked if xt_register_table() fails during table creation. The stack path shows allocation via __alloc_percpu → xt_percpu_counter_alloc → translate_table, then fai...

CVE-2022-50287 drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: fix a memory leak in generatelfpdataptrs When size != 0 || ptrs-lvds entries != 3, the program tries to free the ptrs. However, the ptrs is not created by calling kzmalloc, but is obtained by pointer offset...