UBUNTU-CVE-2023-53248

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: install stub fence into potential unused fence pointers When using cpu to update page tables, vm update fences are unused. Install stub fence into these fence pointers instead of NULL to avoid NULL dereference when...

UBUNTU-CVE-2023-53244

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

UBUNTU-CVE-2023-53225

In the Linux kernel, the following vulnerability has been resolved: spi: imx: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a...

CVE-2023-53248 drm/amdgpu: install stub fence into potential unused fence pointers

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: install stub fence into potential unused fence pointers When using cpu to update page tables, vm update fences are unused. Install stub fence into these fence pointers instead of NULL to avoid NULL dereference when...

CVE-2023-53244 media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68riscbuffer to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf-cpu. Later when we free t...

CVE-2022-50309

CVE-2022-50309 : Linux kernel vulnerability in media: xilinx: vipp, fixed in the commit that adds balance for refcount in xvip_graph_dma_init. The issue arises because of_get_child_by_name() returns a node pointer with its refcount incremented, and there was no corresponding of_node_put() when th...

CVE-2022-50309 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init

In the Linux kernel, the following vulnerability has been resolved: media: xilinx: vipp: Fix refcount leak in xvipgraphdmainit ofgetchildbyname returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2023-53225

The connected details describe CVE-2023-53225 as a Linux kernel issue in the SPI IMX driver where the remove path could skip cleanup of DMA resources on error. The root cause is returning early from a platform driver’s remove callback, leading to a permanent resource leak because DMA resources ma...

CVE-2023-53225 spi: imx: Don't skip cleanup in remove's error path

In the Linux kernel, the following vulnerability has been resolved: spi: imx: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a...

CVE-2023-53225 spi: imx: Don't skip cleanup in remove's error path

In the Linux kernel, the following vulnerability has been resolved: spi: imx: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a...

CVE-2023-53219 media: netup_unidvb: fix use-after-free at del_timer()

In the Linux kernel, the following vulnerability has been resolved: media: netupunidvb: fix use-after-free at deltimer When Universal DVB card is detaching, netupunidvbdmafini uses deltimer to stop dma-timeout timer. But when timer handler netupunidvbdmatimeout is running, deltimer could not stop...

CVE-2023-53181

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc failure Currently dmaresvgetfences will leak the previously allocated array if the fence iteration got restarted and the kreallocarray fails. Free the old array by hand, and make sure we...

DEBIAN-CVE-2023-53171

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of lockedvm via exec When a vfio container is preserved across exec, the task does not change, but it gets a new mm with lockedvm=0, and loses the count from existing dma mappings. If the user later...

CVE-2023-53171

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of lockedvm via exec When a vfio container is preserved across exec, the task does not change, but it gets a new mm with lockedvm=0, and loses the count from existing dma mappings. If the user later...

UBUNTU-CVE-2023-53171

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of lockedvm via exec When a vfio container is preserved across exec, the task does not change, but it gets a new mm with lockedvm=0, and loses the count from existing dma mappings. If the user later...

CVE-2023-53181 dma-buf/dma-resv: Stop leaking on krealloc() failure

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc failure Currently dmaresvgetfences will leak the previously allocated array if the fence iteration got restarted and the kreallocarray fails. Free the old array by hand, and make sure we...

CVE-2023-53171

CVE-2023-53171 affects the Linux kernel’s vfio/type1 path. The issue occurs when a vfio container is preserved across execs: the task’s mm can change to a new mm with locked_vm=0, causing undercounted DMA mappings and a later unmap to underflow locked_vm, leading to ENOMEM on a subsequent dma map...

CVE-2023-53171 vfio/type1: prevent underflow of locked_vm via exec()

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of lockedvm via exec When a vfio container is preserved across exec, the task does not change, but it gets a new mm with lockedvm=0, and loses the count from existing dma mappings. If the user later...

CVE-2023-53171 vfio/type1: prevent underflow of locked_vm via exec()

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of lockedvm via exec When a vfio container is preserved across exec, the task does not change, but it gets a new mm with lockedvm=0, and loses the count from existing dma mappings. If the user later...

kernel: drm/gem: Acquire references on GEM handles for framebuffers

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. 1...