Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: emsusbreadbulkcallback: Check the proper length of a message. When analyzing data in an USB urb, actuallength represents the size of the buffer passed to the driver. However, transferbufferlength, which is set by the...

Astra Linux – Vulnerability in Qemu

A reachable assertion issue was detected in the USB EHCI emulation code of QEMU. This issue can occur during the processing of USB requests due to a faulty handling of the DMA memory map. A malicious privileged user within the guest environment may exploit this flaw to send invalid USB requests,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Fixed a slab-use-after-free in scmibusnotifier. The scmidev-name is released prematurely in scmidevicedestroy, which causes a slab-use-after-free when accessing scmidev-name in scmibusnotifier. Therefore, the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: cihdrcimx: Also search for ‘phys’ handle. When passing ‘phys’ in the device tree to describe the USB PHY handle which is the recommended approach according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check the return value of platformgetresource. platformgetresource returns NULL in case of failure. Therefore, check its return value and propagate the error to prevent NULL pointer dereferencing...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: uhci: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must also contain a call to dput; otherwise, a memory leak will occur over time. To simplify things, simply call...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: r6040: Fixed the kmemleak in the probe process and removed it. There is a memory leak reported by kmemleak: - Unreferenced object 0xffff888116111000 size 2048: comm “modprobe”, pid 817, jiffies 4294759745 age 76.502s Hex dump...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: validate USB endpoints The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it expects before binding to it. If a malicious device does not have the sa...

Astra Linux – Vulnerability in Flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak applications that had direct access to AFUNIX sockets—such as those used by Wayland, Pipewire, or pipewire-pulse—could trick portals and other host-...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint: Fixed error handling in vpciscanbus Smatch complains about inconsistent NULL checking in vpciscanbus: drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpciscanbus error: We previously assumed that ‘vpcibus’ could...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imondisconnect Syzbot reports a KASAN issue as follows: BUG: KASAN: use-after-free in createpipe include/linux/usb.h:1945 inline BUG: KASAN: use-after-free in sendpacket+0xa2d/0xbc0...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Do not generate an interrupt during bus reset. Now that the i2c-i801 driver supports interrupts, setting the KILL bit in an attempt to recover from a timed-out transaction triggers an interrupt. Unfortunately, the...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: misc/uss720: fixed a memory leak in uss720probe. uss720probe forgot to decrease the refcount of usbdev in uss720probe. This issue was fixed by decreasing the refcount of usbdev using usbputdev. BUG: Memory leak Unreferenced objec...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: bus: qcom: Place the child node before the return statement. Placing the child node before the return statement helps to prevent potential reference count leaks. Generally, the reference count of a child node is automatically...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacrubind Syzbot is still reporting a rather old issue 1 that occurs due to incomplete checking of existing USB endpoints. As a result, incorrect endpoint types may be used during the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fixed a flaw in existing endpoint checks Syzbot once again identified a flaw in USB endpoint checking. See 1. This time, the issue stems from a commit authored by me 2eabb655a968, “usb: atm: cxacru: fix endpoint...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: mcp251xfd: fix infinite loop when xmit fails When the mcp251xfdstartxmit function fails, the driver stops processing messages, and the interrupt routine does not return, resulting in an indefinite execution even after...

Astra Linux – Vulnerability in Linux 6.1

A issue was discovered in the Linux kernel through version 6.0.9. In the file drivers/char/xillybus/xillyusb.c, there is a race condition and a use-after-free during the physical removal of a USB device...

Astra Linux – Vulnerability in Keepalived

In Keepalived versions up to 2.2.4, the D-Bus mechanism does not sufficiently restrict the destination of messages, allowing any user to inspect and manipulate any property. This leads to bypasses of access controls in certain situations, where a unrelated D-Bus system service has a settable...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Thermal: Intel: int340x: Processor: Fixed warning during module unloading The processorthermal driver uses pcimdeviceenable to enable a PCI device. This means that the device will be automatically disabled when the driver is...