DEBIAN-CVE-2022-49452

In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: retrieve the virtual address before dmaunmap The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were actually removing the DMA map and then...

DEBIAN-CVE-2022-49320

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: In struct zynqmpdmachan fix descsize data type In zynqmpdmaalloc/freechanresources functions there is a potential overflow in the below expressions. dmaalloccoherentchan-dev, 2 chan-descsize ZYNQMPDMANUMDESC...

DEBIAN-CVE-2022-49268

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Do not call snddmafreepages when snddmaallocpages returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: T1387 sof-audio-pci-intel-tgl...

UBUNTU-CVE-2022-49652

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Fix refcount leak in tidra7xbarrouteallocate ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not needed anymore. Add missing ofnodeput in to fix this...

UBUNTU-CVE-2022-49320

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: In struct zynqmpdmachan fix descsize data type In zynqmpdmaalloc/freechanresources functions there is a potential overflow in the below expressions. dmaalloccoherentchan-dev, 2 chan-descsize ZYNQMPDMANUMDESC...

UBUNTU-CVE-2022-49522

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Do what is done in other DMA-enabled MMC host drivers cf. host/mmci.c and limit the maximum segment size based on the DMA engine's capabilities. This is needed to avoid...

UBUNTU-CVE-2022-49500

In the Linux kernel, the following vulnerability has been resolved: wl1251: dynamically allocate memory used for DMA With introduction of vmap'ed stacks, stack parameters can no longer be used for DMA and now leads to kernel panic. It happens at several places for the wl1251 e.g. when accessed...

UBUNTU-CVE-2022-49592

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left shift overflow issue When queue number is 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTLRXQDMAMAP1. If CONFIGUBSAN is enabled, kernel dumps below warning...

UBUNTU-CVE-2022-49452

In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: retrieve the virtual address before dmaunmap The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were actually removing the DMA map and then...

UBUNTU-CVE-2022-49524

In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: Fix the error handling in cx23885initdev When the driver fails to call the dmasetmask, the driver will get the following splat: 55.853884 BUG: KASAN: use-after-free in processremoveddriver+0x3c/0x240 55.85448...

UBUNTU-CVE-2022-49569

In the Linux kernel, the following vulnerability has been resolved: spi: bcm2835: bcm2835spihandleerr: fix NULL pointer deref for non DMA transfers In case a IRQ based transfer times out the bcm2835spihandleerr function is called. Since commit 1513ceee70f2 "spi: bcm2835: Drop dmapending flag" the...

DEBIAN-CVE-2022-49217

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix abort all task initialization In pm80xxsendabortall, the nelem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task completion path seeing the ccb with a non-zero...

CVE-2022-49137

In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu/amdgpucs: fix refcount leak of a dmafence obj This issue takes place in an error path in amdgpucsfencetohandleioctl. When info-in.what falls into default case, the function simply returns -EINVAL, forgetting to...

DEBIAN-CVE-2022-49137

In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu/amdgpucs: fix refcount leak of a dmafence obj This issue takes place in an error path in amdgpucsfencetohandleioctl. When info-in.what falls into default case, the function simply returns -EINVAL, forgetting to...

CVE-2022-49099

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix initialization of device object in vmbusdeviceregister Initialize the device's dmamask,parms pointers and the device's dmamask value before invoking deviceregister. Address the following trace with 5.17-rc...

DEBIAN-CVE-2022-49099

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix initialization of device object in vmbusdeviceregister Initialize the device's dmamask,parms pointers and the device's dmamask value before invoking deviceregister. Address the following trace with 5.17-rc...

DEBIAN-CVE-2022-49073

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: Fix crash due to OOB write the driver uses libata's "tag" values from in various arrays. Since the mentioned patch bumped the ATATAGINTERNAL to 32, the value of the SATADWCQCMDMAX needs to account for that...

UBUNTU-CVE-2022-49073

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: Fix crash due to OOB write the driver uses libata's "tag" values from in various arrays. Since the mentioned patch bumped the ATATAGINTERNAL to 32, the value of the SATADWCQCMDMAX needs to account for that...

UBUNTU-CVE-2022-49212

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: atmel: fix refcount issue in atmelnandcontrollerinit The reference counting issue happens in several error handling paths on a refcounted object "nc-dmac". In these paths, the function simply returns the error code,...

UBUNTU-CVE-2022-49137

In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu/amdgpucs: fix refcount leak of a dmafence obj This issue takes place in an error path in amdgpucsfencetohandleioctl. When info-in.what falls into default case, the function simply returns -EINVAL, forgetting to...