Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fixed a race condition between concurrent call paths that invoke dwc3removerequests. This patch addresses a race condition caused by unsynchronized execution of multiple call paths that invoke dwc3removerequests, leadi...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “quota”: Fixed the potential NULL pointer dereferencing. The race condition below may cause NULL pointer dereferencing. P1 P2 dquotfreeinode quotaoff dropdquotref removedquotref dquots = idquotinode dquots = idquotinode...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fixed a race condition in qfqaggregate. A race condition can occur when qfqchangeagg is modified called during qfqenqueue while other threads access it concurrently. For example, qfqdumpclass may trigger a NULL...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BUG: NULL pointer dereference in the kernel, address: 0000000000000038 RIP efxnicupdatestats The function efxnetstats doctgetstats64 can be called during an ethtool self-test. During this period, nicdata-mcstats is NULL because t...

Astra Linux – Vulnerability in rsync

A flaw was discovered in rsync. This vulnerability stems from a race condition that occurs during rsync’s handling of symbolic links. The default behavior of rsync when encountering symbolic links is to skip them. If an attacker replaces a regular file with a symbolic link at the appropriate time...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Staging: rtl8712: fixed a use-after-free in rtl8712dlfw Syzbot reported a use-after-free in rtl8712dlfw. The issue occurred due to a race condition between r871xudevremove and dondoopen callbacks. It’s clear from the crash log...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A issue was discovered in the Linux kernel before version 6.2.9. A use-after-free was found in the bq24190remove function in the file drivers/power/supply/bq24190charger.c. This could allow a local attacker to cause the system to crash due to a race condition...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hwrng: virtio – Fixed a race condition related to dataavail and actual data. The virtio rng device initiates a new entropy request whenever the data available becomes zero. When a new request occurs at the end of a read...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: x86 – Handling of SRCU initialization failures during page track initialization Check the return value of initsrcustruct, which may fail due to OOM conditions when initializing the page track mechanism. Lack of checking lead...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfc: st-nci: Fixed a use-after-free bug in ndlcremove due to a race condition This bug affects both stncii2cremove and stncispiremove. Take stncii2cremove as an example. In stncii2cprobe, it calls ndlcprobe and binds &ndlc-smwork...

Astra Linux – Vulnerability in Linux, Linux 5.10

In several functions of binder.c, there is a possibility of representing the wrong domain to SELinux due to a race condition. This could lead to a local escalation of privileges without the need for additional execution privileges. User interaction is not required for exploitation. Product:...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: userfaultfd: Fixes the checks for huge PMDs. Patch series “userfaultfd: fix races around pmdtranshuge check”, v2. The pmdtranshuge code in mfillatomic is incorrect in three different ways, depending on the kernel version: 1. T...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed the issue of not checking the atomicwrite status in f2fs ioctl interfaces. Some f2fs ioctl interfaces, such as f2fsiocsetpinfile, f2fsmovefilerange, and f2fsdefragmentrange, failed to check the atomicwrite status, whi...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SPI: sun6i – Fixing the race condition between DMA RX transfer completion and RX FIFO drain. Previously, the transfer-completion interrupt would immediately drain the RX FIFO to read any remaining data in the FIFO into the RX...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In OpenVSwitch, the defertunnelnetdevput function is delayed until the RCU callback is executed. The ovsnetdevtunnelDestroy function may be executed after NETDEVUNREGISTER has already detached the device. Dropping the reference t...

Astra Linux – Vulnerability in Firefox and Thunderbird

A race condition could allow a cross-origin container to obtain permissions from the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during the docker cp mount setup allowed a malicious container to create empty files or directories at...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In Docker Engine before version 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon before version 2.0.0-beta.14, a race condition during the docker cp mount setup allowed a malicious container to redirect a bind mount target to an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: The probe of the client device is deferred after the SMMU device is bound. A null pointer dereference occurs due to a race between the SMMU driver’s probe and the client driver’s probe. This occurs when the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix race bug in nvmepollirqdisable In the following scenario, pdev can be disabled between 1 and 3 by 2. This sets pdev-msixenabled = 0. Then, pciirqvector will return MSI-X IRQ15 for 1 whereas return INTx IRQcqvector...