Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed an uninitialized value in ‘ext4evict inode’. Syzbot identified the following issue: ===================================================== BUG: KMSAN: Uninitialized value in ext4evict inode+0xdd/0x26b0,...

Astra Linux - уязвимость в apache2

The Apache HTTP Server protocol handler for the HTTP/2 protocol checks the received request headers against the size limitations configured for the server. These restrictions are also applied to the HTTP/1 protocol. If any violations occur, an HTTP response is sent to the client with a status cod...

Astra Linux - уязвимость в linux, linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: lib/fonts: Fixed undefined behavior in bit shifting for getdefaultfont. Shifting a signed 32-bit value by 31 bits is undefined; therefore, the significant bit was changed to unsigned. The UBSAN warning “calltrace” is as follow...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: Do not decrement the preempt count of the idle task when the CPU is offline. With PREEMPTCOUNT=y, when a CPU is offline and then brought back online, we encounter the following issue: BUG: Scheduling while atomic:...

Astra Linux - уязвимость в linux-5.10, linux

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed the bug in ext4mbuse inodepa. Hulk Robot reported a BUGON: kernel BUG at fs/ext4/mballoc.c:3211! ... RIP: 0010:ext4mbmarkdiskspaceused.cold+0x85/0x136f ... Call Trace: ext4mbnewblocks+0x9df/0x5d30...

Astra Linux - уязвимость в linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fixed an out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmapaddirqchipfwnode, the intent is to allocate a matrix with numconfigbases rows and...

Astra Linux - уязвимость в linux-5.15, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: Fixed the issue where the function f2fswaitonpagewriteback was called within f2fswriterawpages. This issue would trigger a bug when writing files concurrently, because the same page could be written back multiple...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: Block, bfq: Fixed a potential Use-after-Free for ‘bfqq-bic’. Our test report identified a Use-after-Free for ‘bfqq-bic’ in 5.10: BUG: KASAN: Use-after-Free in bfqselectqueue+0x378/0xa30 CPU: 6 PID: 2318352 Comm: fsstress Kdump:...

Astra Linux - уязвимость в linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Avoid using prinfo with a spin lock in cblistinitgeneric. prinfo is called with the rtp-cbsgbllock spin lock locked. Since prinfo calls printk, which may cause a sleep, this will result in a bug like the following:...

Astra Linux - уязвимость в linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: The block range must be validated before being used in ext4mbclearbb. The block range to be freed is validated in ext4freeblocks using ext4 inodeblockvalid, and then it is passed to ext4mbclearbb. However, in some situation...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix for double invocation of the request function. If a netfs request completes during the pause loop, the reference belonging to the INPROGRESS flag will be removed at that point. However, if the request proceeds to the...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: mshv: Error handling in mshvregionpin has been fixed. The current error handling has two issues: Firstly, the pinuserpagesfast function may return a short pin count less than the requested count but greater than zero when it...

Astra Linux - уязвимость в chromium

Using “after free” in Vulkan in Google Chrome before version 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: fixed the issue of locking in the ieee80211startap error path. We need to hold the local-mtx to release the channel context; this is even encoded in the lockdepassertheld function. Fix this issue...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a bug in btf DeclTag when tagging a function. syzbot reported a bug in btf DeclTag with a stack trace as follows: - General protection fault, likely for the non-canonical address 0xdffffc0000000000: 0000 1 PREEMPT SMP...

Astra Linux - уязвимость в golang-1.15

In Go versions before 1.14.14 and 1.15.x, as well as before 1.15.7, the crypto/elliptic/p224.go file may generate incorrect outputs due to a underflow of the lowest limb during the final complete reduction of the P-224 field...

Astra Linux - уязвимость в chromium

Before version 96.0.4664.93, using autofill in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Team: Fix for checking whether the port is enabled in teamqueueoverrideportpriochanged. A syzkaller bug was recently reported with the following trace: listdel corruption; ffff888058bea080-prev is LISTPOISON2 dead000000000122...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed a race condition when detecting delalloc ranges during fiemap For fiemap, we recently stopped locking the target extent range for the entire duration of the fiemap call, in order to avoid a deadlock in scenarios wher...

Astra Linux - уязвимость в openssl

To decrypt SM2 encrypted data, an application is expected to call the API function EVPPKEYdecrypt. Typically, an application will call this function twice. The first time, upon entry, the “out” parameter can be NULL, and upon exit, the “outlen” parameter contains the buffer size required to hold...