Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: API – Use a work queue in cryptoDestroyInstance. The function cryptoDropSpawn is expected to be called from the process context. However, when an instance is not registered while it still has active users, the last user m...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: SELinux: The use of both GFPKERNEL and GFPATOMIC in convertcontext was enabled. The following warning was triggered in a hardware environment: SELinux: Converting 162 SID table entries... BUG: The sleeping function was called...

Astra Linux – Vulnerability in Golang-1.19

Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates that contain multiple actions separated by a '/' character may cause the CSS context to close unexpectedly, allowing for the injection of unexpected HTML, if executed with untrusted input...

Astra Linux – Vulnerability in libde265

strukturag libde265 commit d9fea9d was discovered to contain a segmentation fault due to the component decodercontext::computeframedroptable...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: The part of the cdns set that activates the state should be placed outside the spin lock. The device may be scheduled during the resume process; therefore, this issue cannot occur in atomic operations. Since...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: The delay module was unloaded while the fabric scan was in progress. This led to a system crash during the load/unload test. 105954.384919 RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel before version 5.10. The file drivers/infiniband/core/ucma.c contains a use-after-free, as the context of the ctx variable is accessed through ctxlist in certain situations where ucmamigrateid is called, specifically when ucmaclose is invoked. This issue...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: Fixed a use-after-free in the chanctx code. In ieee80211vifusereservedcontext, when there’s an old context and the replacestate of the new context is set to IEEE80211CHANCTXREPLACENONE, the old context is freed in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mptcp: The “kern” flag was removed from fallback sockets. The mptcp ULP extension relies on ensuring that sk-sksockkern is set correctly. This prevents the call to setsockoptfd, IPPROTOTCP, TCPULP, "mptcp", 6 from working for pla...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timerdeletesync from fence-ops.release called on last dmafenceput. In some scenarios, it can run...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: macb: Use devconsumeskbany to free TX SKBs The napiconsumeskb function is not intended to be called in a disabled IRQ context. However, after commit 6bc8a5098bf4 “net: macb: Fix txptrlock locking”, the freeing of TX SKBs is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘sched/fair: Make sure to try to detach at least one movable task’” This change is reflected in commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. The patch b0defa7ae03ec changed the load balancing logic to ignore env.maxlo...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid using the bitfield RMW for control flags related to claims/retunes. Move the control flags related to claims and retunes out of the bitfield to avoid unrelated side effects of RMW in asynchronous contexts. The...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 7.x, 8.x, 9.2.27 and earlier, 9.3.26 and earlier, and 9.4.16 and earlier, the server running on any operating system and Jetty version combination will display a 404 error in the output, indicating that no Context matching the requested path was found. The default server...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Web Browser UI of Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xdp: fixed an invalid wait context in pagepoolDestroy If the driver uses a page pool, it creates a page pool using pagepoolcreate. The reference count of the page pool is 1 by default. A page pool will only be destroyed when its...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: pvrusb2: Fix for a UAF in pvr2contextsetnotify Reported by Syzbot Bug: KASAN: “Slab-use-after-free” in pvr2contextsetnotify+0x2c4/0x310; file: drivers/media/usb/pvrusb2/pvrusb2-context.c, line 35. A 4-byte read at address...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: block, bfq: Fixed the issue in bfqlimitdepth. The process of setting the newly allocated bfqq to bic or removing freed bfqq from bic is protected by bfqd-lock. However, bfqlimitdepth dereferences bfqq from bic without using the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed the issue where preallocated blocks were truncated in f2fsfileopen. Chenyuwen has reported the following f2fs bugs: Unable to handle a NULL pointer dereferencing at the virtual address 0000000000000011...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: regmap: slimbus: Fix the buscontext pointer in regmap init calls The commit 4e65bda8273c “ASoC: wcd934x: Fix error handling in wcd934xCodecParsedata” revealed the issue in the slimbus regmap. This commit causes audio playback ...